{"version":3,"file":"sqlite-policy-guard.mjs","names":[],"sources":["../../src/internal/sqlite-policy-guard.ts"],"sourcesContent":["import * as Array from \"effect/Array\";\nimport * as Effect from \"effect/Effect\";\nimport * as SqlClient from \"effect/sql/SqlClient\";\nimport type * as Statement from \"effect/sql/Statement\";\n\nimport { appendSqlBatchStatement, registerSqlBatchPostcondition } from \"./sql-commit\";\n\nexport interface SqlitePolicyValue {\n  readonly column: Statement.Fragment;\n  readonly value: Statement.Fragment;\n}\n\n/** Check original values before writes and at the end of the same atomic batch.\n * Small groups bound parameters and expression depth without expanding retained\n * values into hex/JSON. BINARY preserves text bytes; IS also compares NULLs. */\nexport const guardSqlitePolicy = Effect.fnUntraced(function* (input: {\n  readonly name: string;\n  readonly table: Statement.Fragment;\n  readonly owner: Statement.Fragment;\n  readonly values: ReadonlyArray<SqlitePolicyValue>;\n}) {\n  const sql = (yield* SqlClient.SqlClient).withoutTransforms();\n\n  for (const values of Array.chunksOf(input.values, 32)) {\n    const matches = sql.and(\n      values.map(({ column, value }) => sql`${column} collate binary is ${value}`),\n    );\n\n    const condition = sql`exists(select 1 from ${input.table} where ${input.owner} and ${matches})`;\n    const statement = sql`select case when ${condition} then 1 else json_extract('[]', '$[auth-batch-precondition]') end as valid`;\n\n    yield* appendSqlBatchStatement(statement);\n    yield* registerSqlBatchPostcondition({ name: input.name, statement });\n  }\n});\n"],"mappings":";;;;;;;;AAeA,MAAa,oBAAoB,OAAO,WAAW,WAAW,OAK3D;CACD,MAAM,OAAO,OAAO,UAAU,UAAA,CAAW,kBAAkB;CAE3D,KAAK,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ,EAAE,GAAG;EACrD,MAAM,UAAU,IAAI,IAClB,OAAO,KAAK,EAAE,QAAQ,YAAY,GAAG,GAAG,OAAO,qBAAqB,OAAO,CAC7E;EAGA,MAAM,YAAY,GAAG,oBAAoB,GADpB,wBAAwB,MAAM,MAAM,SAAS,MAAM,MAAM,OAAO,QAAQ,GAC1C;EAEnD,OAAO,wBAAwB,SAAS;EACxC,OAAO,8BAA8B;GAAE,MAAM,MAAM;GAAM;EAAU,CAAC;CACtE;AACF,CAAC"}