workerstack 0.1.0-beta.0

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 0.1.0-beta.0
+
+First release of Workerstack, split from the Workers rewrite of Bunderstack
+(`bunderstack@1.0.0-beta.4`). Changes against that release:
+
+- The package, CLI, imports, Vite plugin, and blueprint file are renamed to
+  `workerstack` (`workerstack.blueprint.yaml`, `virtual:workerstack/backend`,
+  `WORKERSTACK_*` environment variables). Internal table names stay the same.
+- SQLite only (libsql locally, Turso when hosted). Postgres, PGlite, and the
+  Bun database drivers are removed.
+- Image transforms are removed: they need `Bun.Image`, which Workers lack.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kirill Chuprov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# workerstack
+
+A full-stack framework for Cloudflare Workers. One declaration describes the
+database, auth, API, file buckets, jobs, cron, realtime, and rate limits; the
+TanStack Start app renders on the server in the same Worker.
+
+Workerstack started as the Workers rewrite of Bunderstack. Bunderstack 0.x
+stays the choice for apps that need a long-running Bun process (a headless
+browser, native database drivers, large files in memory).
+
+```sh
+bun add workerstack better-auth drizzle-orm valibot @libsql/client
+bun add -d vite wrangler @cloudflare/vite-plugin drizzle-kit
+```
+
+## The backend
+
+```ts
+// src/workerstack.ts
+import { workerstack } from 'workerstack'
+import { defineAccess } from 'workerstack/access'
+import { libsql } from 'workerstack/libsql'
+import * as v from 'valibot'
+
+import * as schema from './schema'
+
+export const backend = workerstack({
+  schema,
+  database: { adapter: libsql() },
+  access: defineAccess(schema, {
+    notes: { crud: true, list: 'authenticated', create: 'authenticated' },
+  }),
+  auth: ({ env }) => ({
+    baseURL: env.APP_URL,
+    emailAndPassword: { enabled: true },
+  }),
+  storage: { buckets: { media: { upload: { maxSize: '5mb' } } } },
+  realtime: true,
+  rateLimit: { windowMs: 60_000, max: 100 },
+  jobs: (j) =>
+    j.define({
+      noteCreated: j.job({
+        input: v.object({ noteId: v.string() }),
+        handler: async (input, ctx) => {
+          /* ... */
+        },
+      }),
+      nightly: j.cron({ schedule: '0 3 * * *', handler: async () => {} }),
+    }),
+  api: (o) => ({
+    ping: o.public
+      .route({ method: 'GET', path: '/api/ping' })
+      .handler(() => ({ ok: true })),
+  }),
+})
+
+export type App = Awaited<ReturnType<typeof backend.start>>
+```
+
+```ts
+// vite.config.ts — SSR with TanStack Start by default.
+import viteReact from '@vitejs/plugin-react'
+import { defineConfig } from 'vite'
+import { workerstack } from 'workerstack/vite'
+
+export default defineConfig({ plugins: [workerstack(), viteReact()] })
+```
+
+```ts
+// src/api.ts — one client for loaders, server functions, and the browser.
+import { workerstackStart } from 'workerstack/start'
+
+import type { App } from './workerstack'
+
+export const { createQueryClient, createApi } = workerstackStart<App>()
+```
+
+On the server the client calls the backend inside the same isolate and
+forwards the request cookie; in the browser it calls `/api` over HTTP.
+
+## Commands
+
+```sh
+bunx workerstack dev        # sqld + Vite on workerd, the production runtime
+bunx workerstack build      # dist/server/index.js and dist/client
+bunx workerstack blueprint  # writes workerstack.blueprint.yaml
+bunx workerstack wrangler   # writes wrangler.json from the blueprint
+```
+
+`workerstack.blueprint.yaml` is the single source of truth for hosting: the
+database, buckets, Durable Objects (Scheduler, RealtimeHub, RateLimiter), cron,
+and the Worker entry. `wrangler.json` is generated from it. Commit the
+blueprint and the Drizzle migrations; a host deploys from them.
+
+## Runtime
+
+- Database: SQLite through libsql. Locally `workerstack dev` starts sqld;
+  hosted apps use Turso.
+- Files: R2 bindings, one per declared bucket.
+- Jobs and cron: a Scheduler Durable Object wakes on alarms; there is no
+  worker process.
+- Realtime: a RealtimeHub Durable Object fans writes out to subscribers.
+- Rate limits: a RateLimiter Durable Object.
+
+Code runs in a Worker isolate: no file system, no child processes, no native
+modules, and CPU time per request is limited.
+
+## Package subpaths
+
+- `workerstack` — `workerstack()`, the backend declaration
+- `workerstack/access`, `workerstack/schema`, `workerstack/typeid`, `workerstack/env`
+- `workerstack/libsql` — the database adapter
+- `workerstack/vite`, `workerstack/start`, `workerstack/start-auth` — the Vite plugin and TanStack Start integration
+- `workerstack/workers` — Worker entry helpers and the Durable Object classes
+- `workerstack/client*`, `workerstack/query*`, `workerstack/sync`, `workerstack/live` — clients
+- `workerstack/messaging`, `workerstack/email-smtp` — messaging channels
+- `workerstack/testing` — `backend.test()` fixtures for `bun test`
+- `workerstack/blueprint` — the blueprint schema, for hosts
+
+## Examples
+
+- [`examples/ssr-probe`](https://github.com/kirill-dev-pro/workerstack/tree/main/examples/ssr-probe) — SSR with TanStack Start
+- [`examples/workers-probe`](https://github.com/kirill-dev-pro/workerstack/tree/main/examples/workers-probe) — SPA
+- [`examples/agent-chat`](https://github.com/kirill-dev-pro/workerstack/tree/main/examples/agent-chat) — an agent chat with durable streaming
+- [`examples/todo-solid-native`](https://github.com/kirill-dev-pro/workerstack/tree/main/examples/todo-solid-native) — Solid
+
+## Development
+
+```sh
+bun install
+bun run test            # package and repository tests
+bun run test:workers    # builds the probes and runs them on celld (-- --runtime workerd for workerd)
+bun run typecheck:all
+```
+
+## License
+
+MIT

package/dist/access.d.ts

@@ -0,0 +1,131 @@
+export declare const AUTH_TABLE_NAMES: Set<string>;
+export type AccessUserBase = {
+    id: string;
+    email: string;
+    emailVerified?: boolean;
+    name?: string;
+    role?: string;
+};
+export type SessionUserSource = {
+    id: string;
+    email: string;
+    emailVerified?: boolean;
+    name?: string;
+    role?: string;
+} & Record<string, unknown>;
+export type SessionUserConfig<TExtra extends Record<string, unknown> = Record<never, never>> = {
+    mapUser: (user: SessionUserSource) => TExtra;
+};
+export type SessionUserExtraOf<TSession> = TSession extends SessionUserConfig<infer TExtra> ? TExtra : Record<never, never>;
+export type AccessUser<TExtra extends Record<string, unknown> = Record<never, never>> = AccessUserBase & Omit<TExtra, keyof AccessUserBase>;
+export declare function defineSessionUser<const TExtra extends Record<string, unknown>>(config: SessionUserConfig<TExtra>): SessionUserConfig<TExtra>;
+export type AccessContext = {
+    user: AccessUser | null;
+    request: Request;
+    row?: Record<string, unknown>;
+    body?: Record<string, unknown>;
+    session?: {
+        activeOrganizationId: string | null;
+    } | null;
+};
+export type OperationRule = 'public' | 'authenticated' | 'owner' | 'deny' | ((ctx: AccessContext) => boolean | Promise<boolean>);
+export type ScopeMap = Record<string, string | string[]>;
+export type ScopeResolver = (ctx: AccessContext) => ScopeMap;
+export type CrudOperation = 'list' | 'get' | 'create' | 'update' | 'delete';
+export type SortOrder = 'asc' | 'desc';
+export type DefaultSort = {
+    column: string;
+    order: SortOrder;
+};
+export type TableAccessInput = {
+    crud?: boolean;
+    /** Opt the BetterAuth `user` table into auto-CRUD (read profiles, owner-update image). */
+    exposeAuthTable?: boolean;
+    ownerColumn?: string;
+    list?: OperationRule;
+    get?: OperationRule;
+    create?: OperationRule;
+    update?: OperationRule;
+    delete?: OperationRule;
+    /** Explicit write allowlist. Entries override matching system-readonly
+     * defaults such as `updatedAt`; `id` remains immutable on update. */
+    writableColumns?: string[];
+    readonlyColumns?: string[];
+    /** Columns matched by `?q=` on list — opt-in; omitted columns are never searched. */
+    searchableColumns?: string[];
+    /** Columns filterable via flat `?column=value` query params. */
+    filterableColumns?: string[];
+    /** Columns allowed in `?sort=`. Defaults to `['id']`. */
+    sortableColumns?: string[];
+    /** Default list ordering when `?sort` is omitted. Defaults to `{ column: 'id', order: 'desc' }`. */
+    defaultSort?: DefaultSort;
+    scope?: {
+        read?: ScopeResolver;
+        write?: ScopeResolver;
+    };
+};
+export type ResolvedTableAccess = {
+    tableKey: string;
+    tableName: string;
+    enabled: boolean;
+    ownerColumn?: string;
+    list: OperationRule;
+    get: OperationRule;
+    create: OperationRule;
+    update: OperationRule;
+    delete: OperationRule;
+    writableColumns?: string[];
+    readonlyColumns: string[];
+    searchableColumns?: string[];
+    filterableColumns: string[];
+    sortableColumns: string[];
+    defaultSort: DefaultSort;
+    readScope?: ScopeResolver;
+    writeScope?: ScopeResolver;
+};
+export type ResolvedAccess = Map<string, ResolvedTableAccess>;
+/**
+ * Look up a table's resolved access by its physical table name.
+ *
+ * `ResolvedAccess` is keyed by schema export name, not table name, so every
+ * consumer that starts from a physical name needs this scan. It lives here so
+ * CRUD, realtime, and route validation cannot drift apart on which tables they
+ * consider enabled.
+ */
+export declare function tableEntryForName(access: ResolvedAccess, tableName: string): ResolvedTableAccess | undefined;
+export declare function validateAndResolveAccess<TSchema extends Record<string, unknown>>(schema: TSchema, accessInput?: Record<string, TableAccessInput>): ResolvedAccess;
+export declare function defineAccess<TSchema extends Record<string, unknown>, const TRules extends Record<string, TableAccessInput>>(schema: TSchema, rules: TRules): TRules;
+export declare function rowMatchesScope(row: Record<string, unknown>, scope: ScopeMap): boolean;
+export declare function stampScope(values: Record<string, unknown>, scope: ScopeMap): Record<string, unknown>;
+export declare function checkAccessSync(rule: Exclude<OperationRule, (ctx: AccessContext) => boolean | Promise<boolean>>, ctx: AccessContext, ownerColumn?: string): {
+    allowed: boolean;
+};
+export declare function checkAccess(rule: OperationRule, ctx: AccessContext, ownerColumn?: string): Promise<{
+    allowed: boolean;
+    status: 401 | 403;
+}>;
+export declare function sanitizeWriteBody(body: Record<string, unknown>, access: ResolvedTableAccess, mode: 'create' | 'update', userId: string | null): Record<string, unknown>;
+export type AuthSessionResolver<TExtra extends Record<string, unknown> = Record<never, never>> = {
+    api: {
+        getSession: (opts: {
+            headers: Headers;
+        }) => Promise<{
+            user: ({
+                id: string;
+                email: string;
+                emailVerified?: boolean;
+                name?: string;
+                role?: string;
+            } & TExtra) | null;
+            session?: {
+                activeOrganizationId?: string | null;
+            } | null;
+        } | null>;
+    };
+};
+export declare function resolveAccessUser<TExtra extends Record<string, unknown> = Record<never, never>>(auth: AuthSessionResolver<TExtra> | undefined, headers: Headers): Promise<AccessUser<TExtra> | null>;
+export declare function resolveSession<TExtra extends Record<string, unknown> = Record<never, never>>(auth: AuthSessionResolver<TExtra> | undefined, headers: Headers): Promise<{
+    user: AccessUser<TExtra> | null;
+    activeOrganizationId: string | null;
+}>;
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gBAAgB,aAK3B,CAAA;AAIF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,MAAM,iBAAiB,CAC3B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAC3D;IACF,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,MAAM,CAAA;CAC7C,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,QAAQ,IACrC,QAAQ,SAAS,iBAAiB,CAAC,MAAM,MAAM,CAAC,GAC5C,MAAM,GACN,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAE1B,MAAM,MAAM,UAAU,CACpB,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAC3D,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,cAAc,CAAC,CAAA;AAEvD,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5E,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAChC,iBAAiB,CAAC,MAAM,CAAC,CAE3B;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE;QAAE,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;CACzD,CAAA;AAED,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,eAAe,GACf,OAAO,GACP,MAAM,GACN,CAAC,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;AAExD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AACxD,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,QAAQ,CAAA;AAE5D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE3E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,CAAA;AAEtC,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,SAAS,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,0FAA0F;IAC1F,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,GAAG,CAAC,EAAE,aAAa,CAAA;IACnB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB;yEACqE;IACrE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,oGAAoG;IACpG,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,aAAa,CAAA;QACpB,KAAK,CAAC,EAAE,aAAa,CAAA;KACtB,CAAA;CACF,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,aAAa,CAAA;IACnB,GAAG,EAAE,aAAa,CAAA;IAClB,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,aAAa,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,iBAAiB,EAAE,MAAM,EAAE,CAAA;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,UAAU,CAAC,EAAE,aAAa,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;AAE7D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,cAAc,EACtB,SAAS,EAAE,MAAM,GAChB,mBAAmB,GAAG,SAAS,CAKjC;AA+GD,wBAAgB,wBAAwB,CACtC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEvC,MAAM,EAAE,OAAO,EACf,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC7C,cAAc,CA4IhB;AAED,wBAAgB,YAAY,CAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACrD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGxC;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,KAAK,EAAE,QAAQ,GACd,OAAO,CAWT;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,QAAQ,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,CACX,aAAa,EACb,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CACnD,EACD,GAAG,EAAE,aAAa,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAWtB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,aAAa,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAwBlD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,QAAQ,GAAG,QAAQ,EACzB,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB;AAED,MAAM,MAAM,mBAAmB,CAC7B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAC3D;IACF,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC;YAClD,IAAI,EACA,CAAC;gBACC,EAAE,EAAE,MAAM,CAAA;gBACV,KAAK,EAAE,MAAM,CAAA;gBACb,aAAa,CAAC,EAAE,OAAO,CAAA;gBACvB,IAAI,CAAC,EAAE,MAAM,CAAA;gBACb,IAAI,CAAC,EAAE,MAAM,CAAA;aACd,GAAG,MAAM,CAAC,GACX,IAAI,CAAA;YACR,OAAO,CAAC,EAAE;gBAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;aAAE,GAAG,IAAI,CAAA;SAC1D,GAAG,IAAI,CAAC,CAAA;KACV,CAAA;CACF,CAAA;AAED,wBAAsB,iBAAiB,CACrC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAE7D,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,SAAS,EAC7C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAapC;AAED,wBAAsB,cAAc,CAClC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAE7D,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,SAAS,EAC7C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC;IACT,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;IAC/B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC,CAAC,CAeD"}

package/dist/access.js

@@ -0,0 +1,333 @@
+import { getTableColumns, getTableName, isTable } from 'drizzle-orm';
+import { INTERNAL_TABLE_NAMES } from './internal-tables.js';
+export const AUTH_TABLE_NAMES = new Set([
+    'user',
+    'session',
+    'account',
+    'verification',
+]);
+const EXPOSEABLE_AUTH_TABLES = new Set(['user']);
+export function defineSessionUser(config) {
+    return config;
+}
+/**
+ * Look up a table's resolved access by its physical table name.
+ *
+ * `ResolvedAccess` is keyed by schema export name, not table name, so every
+ * consumer that starts from a physical name needs this scan. It lives here so
+ * CRUD, realtime, and route validation cannot drift apart on which tables they
+ * consider enabled.
+ */
+export function tableEntryForName(access, tableName) {
+    for (const entry of access.values()) {
+        if (entry.tableName === tableName)
+            return entry;
+    }
+    return undefined;
+}
+const DEFAULT_READONLY = [
+    'id',
+    'createdAt',
+    'updatedAt',
+    'created_at',
+    'updated_at',
+];
+function getSchemaTables(schema) {
+    const tables = [];
+    for (const [key, value] of Object.entries(schema)) {
+        if (!isTable(value))
+            continue;
+        const name = getTableName(value);
+        const columns = Object.keys(getTableColumns(value));
+        tables.push({ key, table: value, name, columns });
+    }
+    return tables;
+}
+function resolveListAccess(input, columns) {
+    const sortableColumns = input.sortableColumns ?? (columns.includes('id') ? ['id'] : []);
+    const defaultSort = input.defaultSort ?? {
+        column: sortableColumns[0] ?? 'id',
+        order: 'desc',
+    };
+    if (!columns.includes(defaultSort.column)) {
+        throw new Error(`[workerstack] defaultSort.column "${defaultSort.column}" is not a column on this table`);
+    }
+    if (!sortableColumns.includes(defaultSort.column)) {
+        throw new Error(`[workerstack] defaultSort.column "${defaultSort.column}" must be listed in sortableColumns`);
+    }
+    const filterableColumns = input.filterableColumns ?? [];
+    for (const col of filterableColumns) {
+        if (!columns.includes(col)) {
+            throw new Error(`[workerstack] filterableColumns references unknown column "${col}"`);
+        }
+    }
+    for (const col of sortableColumns) {
+        if (!columns.includes(col)) {
+            throw new Error(`[workerstack] sortableColumns references unknown column "${col}"`);
+        }
+    }
+    return { filterableColumns, sortableColumns, defaultSort };
+}
+function resolveDefaults(input, ownerColumn, columns) {
+    const listAccess = resolveListAccess(input, columns);
+    const explicitlyWritable = new Set(input.writableColumns ?? []);
+    return {
+        ownerColumn,
+        list: input.list ?? 'public',
+        get: input.get ?? 'public',
+        create: input.create ?? 'public',
+        update: input.update ?? (ownerColumn ? 'owner' : 'deny'),
+        delete: input.delete ?? (ownerColumn ? 'owner' : 'deny'),
+        writableColumns: input.writableColumns,
+        readonlyColumns: [
+            ...DEFAULT_READONLY.filter((column) => column === 'id' || !explicitlyWritable.has(column)),
+            ...(input.readonlyColumns ?? []),
+            ...(ownerColumn ? [ownerColumn] : []),
+        ],
+        searchableColumns: input.searchableColumns,
+        readScope: input.scope?.read,
+        writeScope: input.scope?.write,
+        ...listAccess,
+    };
+}
+function detectOwnerColumn(columns, input) {
+    if (input?.ownerColumn)
+        return input.ownerColumn;
+    if (columns.includes('userId'))
+        return 'userId';
+    return undefined;
+}
+export function validateAndResolveAccess(schema, accessInput) {
+    const tables = getSchemaTables(schema);
+    const tableByKey = new Map(tables.map((t) => [t.key, t]));
+    const resolved = new Map();
+    if (accessInput) {
+        for (const key of Object.keys(accessInput)) {
+            if (!tableByKey.has(key)) {
+                throw new Error(`[workerstack] access.${key} does not match any table in schema`);
+            }
+            const tableName = tableByKey.get(key).name;
+            const input = accessInput[key];
+            if (AUTH_TABLE_NAMES.has(tableName)) {
+                if (input?.crud === false)
+                    continue;
+                if (!EXPOSEABLE_AUTH_TABLES.has(tableName) || !input?.exposeAuthTable) {
+                    throw new Error(`[workerstack] access.${key} cannot target auth table "${tableName}" — use { crud: false } to silence, or exposeAuthTable on user`);
+                }
+            }
+        }
+    }
+    for (const { key, name, columns } of tables) {
+        const input = accessInput?.[key];
+        if (input?.crud === false)
+            continue;
+        if (INTERNAL_TABLE_NAMES.has(name))
+            continue;
+        if (AUTH_TABLE_NAMES.has(name)) {
+            if (!input?.exposeAuthTable || !EXPOSEABLE_AUTH_TABLES.has(name))
+                continue;
+            const ownerColumn = input.ownerColumn ?? 'id';
+            if (!columns.includes(ownerColumn)) {
+                throw new Error(`[workerstack] access.${key}.ownerColumn "${ownerColumn}" is not a column on table "${name}"`);
+            }
+            const defaults = resolveDefaults({
+                ...input,
+                create: input.create ?? 'deny',
+                delete: input.delete ?? 'deny',
+            }, ownerColumn, columns);
+            const existingReadonly = defaults.readonlyColumns.filter((col) => columns.includes(col));
+            const resolvedReadonly = [...new Set(existingReadonly)];
+            for (const col of [
+                ...(defaults.writableColumns ?? []),
+                ...(defaults.searchableColumns ?? []),
+                ...defaults.filterableColumns,
+                ...defaults.sortableColumns,
+                ...resolvedReadonly,
+            ]) {
+                if (!columns.includes(col)) {
+                    throw new Error(`[workerstack] access.${key} references unknown column "${col}" on table "${name}"`);
+                }
+            }
+            resolved.set(key, {
+                tableKey: key,
+                tableName: name,
+                enabled: true,
+                ...defaults,
+                readonlyColumns: resolvedReadonly,
+            });
+            continue;
+        }
+        const ownerColumn = detectOwnerColumn(columns, input);
+        const hasExplicitRules = input !== undefined;
+        const hasConventionOwner = ownerColumn !== undefined &&
+            input?.ownerColumn === undefined &&
+            columns.includes('userId');
+        if (!hasExplicitRules && !hasConventionOwner)
+            continue;
+        if (!ownerColumn &&
+            input?.crud !== true &&
+            !input?.scope?.read &&
+            !input?.scope?.write)
+            continue;
+        if (input?.ownerColumn && !columns.includes(input.ownerColumn)) {
+            throw new Error(`[workerstack] access.${key}.ownerColumn "${input.ownerColumn}" is not a column on table "${name}"`);
+        }
+        const defaults = resolveDefaults(input ?? {}, ownerColumn, columns);
+        const existingReadonly = defaults.readonlyColumns.filter((col) => columns.includes(col));
+        const resolvedReadonly = [...new Set(existingReadonly)];
+        for (const col of [
+            ...(defaults.writableColumns ?? []),
+            ...(defaults.searchableColumns ?? []),
+            ...defaults.filterableColumns,
+            ...defaults.sortableColumns,
+            ...resolvedReadonly,
+        ]) {
+            if (!columns.includes(col)) {
+                throw new Error(`[workerstack] access.${key} references unknown column "${col}" on table "${name}"`);
+            }
+        }
+        const needsOwner = [defaults.update, defaults.delete].some((r) => r === 'owner');
+        if (needsOwner && !ownerColumn) {
+            throw new Error(`[workerstack] access.${key} requires ownerColumn for owner-based update/delete rules`);
+        }
+        resolved.set(key, {
+            tableKey: key,
+            tableName: name,
+            enabled: true,
+            ...defaults,
+            readonlyColumns: resolvedReadonly,
+        });
+    }
+    return resolved;
+}
+export function defineAccess(schema, rules) {
+    validateAndResolveAccess(schema, rules);
+    return rules;
+}
+export function rowMatchesScope(row, scope) {
+    for (const [col, expected] of Object.entries(scope)) {
+        const actual = row[col];
+        if (actual == null)
+            return false;
+        if (Array.isArray(expected)) {
+            if (!expected.map(String).includes(String(actual)))
+                return false;
+        }
+        else if (String(actual) !== String(expected)) {
+            return false;
+        }
+    }
+    return true;
+}
+export function stampScope(values, scope) {
+    const out = { ...values };
+    for (const [col, expected] of Object.entries(scope)) {
+        if (!Array.isArray(expected))
+            out[col] = expected;
+    }
+    return out;
+}
+export function checkAccessSync(rule, ctx, ownerColumn) {
+    if (rule === 'deny')
+        return { allowed: false };
+    if (rule === 'public')
+        return { allowed: true };
+    if (!ctx.user)
+        return { allowed: false };
+    if (rule === 'authenticated')
+        return { allowed: true };
+    if (rule === 'owner') {
+        if (!ownerColumn)
+            return { allowed: false };
+        const owner = ctx.row?.[ownerColumn];
+        return { allowed: owner != null && String(owner) === ctx.user.id };
+    }
+    return { allowed: false };
+}
+export async function checkAccess(rule, ctx, ownerColumn) {
+    if (rule === 'deny')
+        return { allowed: false, status: 403 };
+    if (typeof rule === 'function') {
+        return (await rule(ctx))
+            ? { allowed: true, status: 403 }
+            : { allowed: false, status: 403 };
+    }
+    if (rule === 'public')
+        return { allowed: true, status: 403 };
+    if (!ctx.user)
+        return { allowed: false, status: 401 };
+    if (rule === 'authenticated')
+        return { allowed: true, status: 403 };
+    if (rule === 'owner') {
+        if (!ownerColumn)
+            return { allowed: false, status: 403 };
+        const rowOwner = ctx.row?.[ownerColumn] ?? ctx.body?.[ownerColumn];
+        if (rowOwner == null)
+            return { allowed: false, status: 403 };
+        if (String(rowOwner) !== ctx.user.id)
+            return { allowed: false, status: 403 };
+        return { allowed: true, status: 403 };
+    }
+    return { allowed: false, status: 403 };
+}
+export function sanitizeWriteBody(body, access, mode, userId) {
+    const out = {};
+    const readonly = new Set(access.readonlyColumns);
+    for (const [key, value] of Object.entries(body)) {
+        // On create, allow client-supplied `id` even if it appears in readonlyColumns,
+        // but still respect an explicit writableColumns allowlist if provided.
+        if (mode === 'create' && key === 'id') {
+            if (access.writableColumns && !access.writableColumns.includes(key))
+                continue;
+            out[key] = value;
+            continue;
+        }
+        if (readonly.has(key))
+            continue;
+        if (access.writableColumns && !access.writableColumns.includes(key))
+            continue;
+        out[key] = value;
+    }
+    if (mode === 'create' && access.ownerColumn) {
+        out[access.ownerColumn] = userId ?? null;
+    }
+    if (mode === 'update' && access.ownerColumn) {
+        delete out[access.ownerColumn];
+    }
+    return out;
+}
+export async function resolveAccessUser(auth, headers) {
+    if (!auth)
+        return null;
+    const session = await auth.api.getSession({ headers });
+    if (!session?.user)
+        return null;
+    const user = {
+        ...session.user,
+        id: session.user.id,
+        email: session.user.email,
+        emailVerified: session.user.emailVerified === true,
+        name: session.user.name,
+        role: session.user.role,
+    };
+    return user;
+}
+export async function resolveSession(auth, headers) {
+    if (!auth)
+        return { user: null, activeOrganizationId: null };
+    const session = await auth.api.getSession({ headers });
+    if (!session?.user)
+        return { user: null, activeOrganizationId: null };
+    return {
+        user: {
+            ...session.user,
+            id: session.user.id,
+            email: session.user.email,
+            emailVerified: session.user.emailVerified === true,
+            name: session.user.name,
+            role: session.user.role,
+        },
+        activeOrganizationId: session.session?.activeOrganizationId ?? null,
+    };
+}
+//# sourceMappingURL=access.js.map