@lunora/client 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/ssr/index.d.mts

@@ -1,27 +1,28 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-CbnxmuqG.mjs";
-export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/lunora-client.d-CbnxmuqG.mjs";
-export { p as preloadQuery, a as preloadedQueryResult } from "../packem_shared/preload.d-Bhq6DBSe.mjs";
+import { P as Preloaded } from "../packem_shared/types.d-CA7ZeJm9.mjs";
+export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/types.d-CA7ZeJm9.mjs";
+export { p as preloadQuery, a as preloadedQueryResult } from "../packem_shared/preload.d-BgoF8JQZ.mjs";
+import { L as LunoraClient } from "../packem_shared/lunora-client.d-BRXKXo0T.mjs";
 import '@lunora/runtime';
 /**
-* Structural shape of a better-auth `getSession` call's resolved value.
-*
-* better-auth's `auth.api.getSession({ headers })` returns `{ user, session }`
-* when a valid session cookie is present, or `null` otherwise. We keep `user`
-* and `session` as open records so `@lunora/client/ssr` carries no hard dependency on
-* better-auth's concrete `User`/`Session` types — the adapter passing the real
-* `auth` instance keeps full inference, while this package stays decoupled.
-*/
+ * Structural shape of a better-auth `getSession` call's resolved value.
+ *
+ * better-auth's `auth.api.getSession({ headers })` returns `{ user, session }`
+ * when a valid session cookie is present, or `null` otherwise. We keep `user`
+ * and `session` as open records so `@lunora/client/ssr` carries no hard dependency on
+ * better-auth's concrete `User`/`Session` types — the adapter passing the real
+ * `auth` instance keeps full inference, while this package stays decoupled.
+ */
 interface ServerSession<User extends Record<string, unknown> = Record<string, unknown>, Session extends Record<string, unknown> = Record<string, unknown>> {
   readonly session: Session;
   readonly user: User;
 }
 /**
-* Structural subset of a better-auth instance: just the one endpoint
-* `getServerSession` needs. Typing it this way (rather than importing
-* `@lunora/auth`'s `LunoraAuth`) means `@lunora/client/ssr` does not depend on
-* better-auth internals — any object exposing `api.getSession` works, including
-* a test stub. The concrete return type is inferred from the passed instance.
-*/
+ * Structural subset of a better-auth instance: just the one endpoint
+ * `getServerSession` needs. Typing it this way (rather than importing
+ * `@lunora/auth`'s `LunoraAuth`) means `@lunora/client/ssr` does not depend on
+ * better-auth internals — any object exposing `api.getSession` works, including
+ * a test stub. The concrete return type is inferred from the passed instance.
+ */
 interface AuthLike<Result = ServerSession | null> {
   readonly api: {
     getSession: (input: {
@@ -30,86 +31,86 @@ interface AuthLike<Result = ServerSession | null> {
   };
 }
 /**
-* Anything `getServerSession` can read request headers from: a `Request`, a
-* `Headers` object, or a plain object exposing `headers`. SSR loaders across
-* meta-frameworks hand back slightly different request objects, so accept the
-* common shapes rather than forcing the caller to unwrap.
-*/
+ * Anything `getServerSession` can read request headers from: a `Request`, a
+ * `Headers` object, or a plain object exposing `headers`. SSR loaders across
+ * meta-frameworks hand back slightly different request objects, so accept the
+ * common shapes rather than forcing the caller to unwrap.
+ */
 type HeadersSource = Headers | Request | {
   readonly headers: Headers;
 };
 /**
-* Resolve the signed-in session from a request inside an SSR loader.
-*
-* Wraps `auth.api.getSession({ headers })` — the helper every meta-framework
-* app otherwise hand-rolls — so a loader can read identity off the inbound
-* cookies in one call. Returns `{ user, session }` when a valid session cookie
-* is present, or `null` for anonymous requests.
-*
-* The `auth` parameter is structurally typed ({@link AuthLike}), so this
-* package does not depend on better-auth internals; pass a real
-* `@lunora/auth` instance to keep full type inference on `user`/`session`.
-* Forward the resolved session's token to `createServerClient` to run the
-* server-side load (and the later WS subscription) as the same identity.
-*/
+ * Resolve the signed-in session from a request inside an SSR loader.
+ *
+ * Wraps `auth.api.getSession({ headers })` — the helper every meta-framework
+ * app otherwise hand-rolls — so a loader can read identity off the inbound
+ * cookies in one call. Returns `{ user, session }` when a valid session cookie
+ * is present, or `null` for anonymous requests.
+ *
+ * The `auth` parameter is structurally typed ({@link AuthLike}), so this
+ * package does not depend on better-auth internals; pass a real
+ * `@lunora/auth` instance to keep full type inference on `user`/`session`.
+ * Forward the resolved session's token to `createServerClient` to run the
+ * server-side load (and the later WS subscription) as the same identity.
+ */
 declare const getServerSession: <Result>(request: HeadersSource, auth: AuthLike<Result>) => Promise<NonNullable<Result> | null>;
 /**
-* Serialize a {@link Preloaded} token to a JSON string for embedding in the
-* rendered HTML (e.g. a `&lt;script>` payload the client
-* reads on hydration). Every field of `Preloaded` is JSON-serializable by
-* construction — `preloadQuery` only captures the query args, function path,
-* optional shard key, and the resolved value — so this is a thin, explicit
-* `JSON.stringify` that documents the dehydration seam and keeps callers from
-* accidentally stringifying a non-serializable wrapper.
-*
-* The `&lt;` is escaped to `&lt;` so the payload is safe to inline inside a
-* `&lt;script>` tag without a stray `&lt;/script>` (or `&lt;!--`) prematurely closing
-* it — the standard XSS-safe script-embedding precaution. This escaping is NOT
-* sufficient for an HTML *attribute* sink (which also needs the quote and `&amp;`
-* characters escaped); embed the output in a raw-text script element, not a
-* data attribute.
-*/
+ * Serialize a {@link Preloaded} token to a JSON string for embedding in the
+ * rendered HTML (e.g. a `<script>` payload the client
+ * reads on hydration). Every field of `Preloaded` is JSON-serializable by
+ * construction — `preloadQuery` only captures the query args, function path,
+ * optional shard key, and the resolved value — so this is a thin, explicit
+ * `JSON.stringify` that documents the dehydration seam and keeps callers from
+ * accidentally stringifying a non-serializable wrapper.
+ *
+ * The `<` is escaped to `<` so the payload is safe to inline inside a
+ * `<script>` tag without a stray `<\/script>` (or `<!--`) prematurely closing
+ * it — the standard XSS-safe script-embedding precaution. This escaping is NOT
+ * sufficient for an HTML *attribute* sink (which also needs the quote and `&`
+ * characters escaped); embed the output in a raw-text script element, not a
+ * data attribute.
+ */
 declare const serializePreloaded: <T>(preloaded: Preloaded<T>) => string;
 /**
-* Inverse of {@link serializePreloaded}: parse a serialized token back into a
-* {@link Preloaded} value on the client. The `&lt;` escape from serialization
-* is transparent to `JSON.parse`, so no un-escaping step is needed.
-*/
+ * Inverse of {@link serializePreloaded}: parse a serialized token back into a
+ * {@link Preloaded} value on the client. The `<` escape from serialization
+ * is transparent to `JSON.parse`, so no un-escaping step is needed.
+ */
 declare const deserializePreloaded: <T = unknown>(serialized: string) => Preloaded<T>;
 /** Options accepted by {@link createServerClient}. */
 interface ServerClientOptions {
   /**
-  * `fetch` implementation used for HTTP RPC. Defaults to the ambient global
-  * `fetch` (present in Node 18+, Workers, and meta-framework SSR runtimes).
-  * Pass one explicitly to forward cookies/headers or to use an instrumented
-  * fetch.
-  */
+   * `fetch` implementation used for HTTP RPC. Defaults to the ambient global
+   * `fetch` (present in Node 18+, Workers, and meta-framework SSR runtimes).
+   * Pass one explicitly to forward cookies/headers or to use an instrumented
+   * fetch.
+   */
   fetch?: typeof fetch;
   /**
-  * Bearer token sent as `Authorization: Bearer &lt;token>` on every RPC. In an
-  * SSR loader you typically read this from the request (e.g. the session
-  * resolved by `getServerSession`) and pass it here so the server-side
-  * load runs as the signed-in user — and so the client subscription that
-  * resumes after hydration carries the same identity.
-  */
+   * Bearer token sent as `Authorization: Bearer <token>` on every RPC. In an
+   * SSR loader you typically read this from the request (e.g. the session
+   * resolved by `getServerSession`) and pass it here so the server-side
+   * load runs as the signed-in user — and so the client subscription that
+   * resumes after hydration carries the same identity.
+   */
   token?: string;
   /** Base URL of the deployed Lunora worker, e.g. `https://app.example.workers.dev`. */
   url: string;
 }
 /**
-* Build a request-scoped {@link LunoraClient} for use inside an SSR loader. SSR
-* data loading only ever calls `.query()` (HTTP RPC over `fetch`); a
-* `LunoraClient` opens a socket lazily on `.subscribe()`/`.stream()` and those
-* are never called server-side, so no live connection is established even if the
-* server runtime happens to expose a global `WebSocket`.
-*
-* Create one per request rather than sharing a module-level instance: the bearer
-* token (and any forwarded cookies in `fetch`) are per-user, and a shared client
-* would leak one request's identity into another.
-*
-* This is the framework-neutral home of the helper that previously lived only in
-* `@lunora/react/server`; the React server module re-exports the same surface so
-* existing imports keep working.
-*/
+ * Build a request-scoped {@link LunoraClient} for use inside an SSR loader. SSR
+ * data loading only ever calls `.query()` (HTTP RPC over `fetch`); a
+ * `LunoraClient` opens a socket lazily on `.subscribe()`/`.stream()` and those
+ * are never called server-side, so no live connection is established even if the
+ * server runtime happens to expose a global `WebSocket`.
+ *
+ * Create one per request rather than sharing a module-level instance: the bearer
+ * token (and any forwarded cookies in `fetch`) are per-user, and a shared client
+ * would leak one request's identity into another.
+ *
+ * This is the framework-neutral home of the helper that previously lived only in
+ * `@lunora/react/server`; the React server module re-exports the same surface so
+ * existing imports keep working.
+ */
 declare const createServerClient: (options: ServerClientOptions) => LunoraClient;
 export { type AuthLike, type HeadersSource, type Preloaded, type ServerClientOptions, type ServerSession, createServerClient, deserializePreloaded, getServerSession, serializePreloaded };

package/dist/ssr/index.d.ts

@@ -1,27 +1,28 @@
-import { P as Preloaded, L as LunoraClient } from "../packem_shared/lunora-client.d-CbnxmuqG.js";
-export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/lunora-client.d-CbnxmuqG.js";
-export { p as preloadQuery, a as preloadedQueryResult } from "../packem_shared/preload.d-C73DT6bL.js";
+import { P as Preloaded } from "../packem_shared/types.d-CA7ZeJm9.js";
+export type { A as ArgsOf, F as FunctionReference, R as ReturnOf } from "../packem_shared/types.d-CA7ZeJm9.js";
+export { p as preloadQuery, a as preloadedQueryResult } from "../packem_shared/preload.d-cq7evweX.js";
+import { L as LunoraClient } from "../packem_shared/lunora-client.d-B23myJYW.js";
 import '@lunora/runtime';
 /**
-* Structural shape of a better-auth `getSession` call's resolved value.
-*
-* better-auth's `auth.api.getSession({ headers })` returns `{ user, session }`
-* when a valid session cookie is present, or `null` otherwise. We keep `user`
-* and `session` as open records so `@lunora/client/ssr` carries no hard dependency on
-* better-auth's concrete `User`/`Session` types — the adapter passing the real
-* `auth` instance keeps full inference, while this package stays decoupled.
-*/
+ * Structural shape of a better-auth `getSession` call's resolved value.
+ *
+ * better-auth's `auth.api.getSession({ headers })` returns `{ user, session }`
+ * when a valid session cookie is present, or `null` otherwise. We keep `user`
+ * and `session` as open records so `@lunora/client/ssr` carries no hard dependency on
+ * better-auth's concrete `User`/`Session` types — the adapter passing the real
+ * `auth` instance keeps full inference, while this package stays decoupled.
+ */
 interface ServerSession<User extends Record<string, unknown> = Record<string, unknown>, Session extends Record<string, unknown> = Record<string, unknown>> {
   readonly session: Session;
   readonly user: User;
 }
 /**
-* Structural subset of a better-auth instance: just the one endpoint
-* `getServerSession` needs. Typing it this way (rather than importing
-* `@lunora/auth`'s `LunoraAuth`) means `@lunora/client/ssr` does not depend on
-* better-auth internals — any object exposing `api.getSession` works, including
-* a test stub. The concrete return type is inferred from the passed instance.
-*/
+ * Structural subset of a better-auth instance: just the one endpoint
+ * `getServerSession` needs. Typing it this way (rather than importing
+ * `@lunora/auth`'s `LunoraAuth`) means `@lunora/client/ssr` does not depend on
+ * better-auth internals — any object exposing `api.getSession` works, including
+ * a test stub. The concrete return type is inferred from the passed instance.
+ */
 interface AuthLike<Result = ServerSession | null> {
   readonly api: {
     getSession: (input: {
@@ -30,86 +31,86 @@ interface AuthLike<Result = ServerSession | null> {
   };
 }
 /**
-* Anything `getServerSession` can read request headers from: a `Request`, a
-* `Headers` object, or a plain object exposing `headers`. SSR loaders across
-* meta-frameworks hand back slightly different request objects, so accept the
-* common shapes rather than forcing the caller to unwrap.
-*/
+ * Anything `getServerSession` can read request headers from: a `Request`, a
+ * `Headers` object, or a plain object exposing `headers`. SSR loaders across
+ * meta-frameworks hand back slightly different request objects, so accept the
+ * common shapes rather than forcing the caller to unwrap.
+ */
 type HeadersSource = Headers | Request | {
   readonly headers: Headers;
 };
 /**
-* Resolve the signed-in session from a request inside an SSR loader.
-*
-* Wraps `auth.api.getSession({ headers })` — the helper every meta-framework
-* app otherwise hand-rolls — so a loader can read identity off the inbound
-* cookies in one call. Returns `{ user, session }` when a valid session cookie
-* is present, or `null` for anonymous requests.
-*
-* The `auth` parameter is structurally typed ({@link AuthLike}), so this
-* package does not depend on better-auth internals; pass a real
-* `@lunora/auth` instance to keep full type inference on `user`/`session`.
-* Forward the resolved session's token to `createServerClient` to run the
-* server-side load (and the later WS subscription) as the same identity.
-*/
+ * Resolve the signed-in session from a request inside an SSR loader.
+ *
+ * Wraps `auth.api.getSession({ headers })` — the helper every meta-framework
+ * app otherwise hand-rolls — so a loader can read identity off the inbound
+ * cookies in one call. Returns `{ user, session }` when a valid session cookie
+ * is present, or `null` for anonymous requests.
+ *
+ * The `auth` parameter is structurally typed ({@link AuthLike}), so this
+ * package does not depend on better-auth internals; pass a real
+ * `@lunora/auth` instance to keep full type inference on `user`/`session`.
+ * Forward the resolved session's token to `createServerClient` to run the
+ * server-side load (and the later WS subscription) as the same identity.
+ */
 declare const getServerSession: <Result>(request: HeadersSource, auth: AuthLike<Result>) => Promise<NonNullable<Result> | null>;
 /**
-* Serialize a {@link Preloaded} token to a JSON string for embedding in the
-* rendered HTML (e.g. a `&lt;script>` payload the client
-* reads on hydration). Every field of `Preloaded` is JSON-serializable by
-* construction — `preloadQuery` only captures the query args, function path,
-* optional shard key, and the resolved value — so this is a thin, explicit
-* `JSON.stringify` that documents the dehydration seam and keeps callers from
-* accidentally stringifying a non-serializable wrapper.
-*
-* The `&lt;` is escaped to `&lt;` so the payload is safe to inline inside a
-* `&lt;script>` tag without a stray `&lt;/script>` (or `&lt;!--`) prematurely closing
-* it — the standard XSS-safe script-embedding precaution. This escaping is NOT
-* sufficient for an HTML *attribute* sink (which also needs the quote and `&amp;`
-* characters escaped); embed the output in a raw-text script element, not a
-* data attribute.
-*/
+ * Serialize a {@link Preloaded} token to a JSON string for embedding in the
+ * rendered HTML (e.g. a `<script>` payload the client
+ * reads on hydration). Every field of `Preloaded` is JSON-serializable by
+ * construction — `preloadQuery` only captures the query args, function path,
+ * optional shard key, and the resolved value — so this is a thin, explicit
+ * `JSON.stringify` that documents the dehydration seam and keeps callers from
+ * accidentally stringifying a non-serializable wrapper.
+ *
+ * The `<` is escaped to `<` so the payload is safe to inline inside a
+ * `<script>` tag without a stray `<\/script>` (or `<!--`) prematurely closing
+ * it — the standard XSS-safe script-embedding precaution. This escaping is NOT
+ * sufficient for an HTML *attribute* sink (which also needs the quote and `&`
+ * characters escaped); embed the output in a raw-text script element, not a
+ * data attribute.
+ */
 declare const serializePreloaded: <T>(preloaded: Preloaded<T>) => string;
 /**
-* Inverse of {@link serializePreloaded}: parse a serialized token back into a
-* {@link Preloaded} value on the client. The `&lt;` escape from serialization
-* is transparent to `JSON.parse`, so no un-escaping step is needed.
-*/
+ * Inverse of {@link serializePreloaded}: parse a serialized token back into a
+ * {@link Preloaded} value on the client. The `<` escape from serialization
+ * is transparent to `JSON.parse`, so no un-escaping step is needed.
+ */
 declare const deserializePreloaded: <T = unknown>(serialized: string) => Preloaded<T>;
 /** Options accepted by {@link createServerClient}. */
 interface ServerClientOptions {
   /**
-  * `fetch` implementation used for HTTP RPC. Defaults to the ambient global
-  * `fetch` (present in Node 18+, Workers, and meta-framework SSR runtimes).
-  * Pass one explicitly to forward cookies/headers or to use an instrumented
-  * fetch.
-  */
+   * `fetch` implementation used for HTTP RPC. Defaults to the ambient global
+   * `fetch` (present in Node 18+, Workers, and meta-framework SSR runtimes).
+   * Pass one explicitly to forward cookies/headers or to use an instrumented
+   * fetch.
+   */
   fetch?: typeof fetch;
   /**
-  * Bearer token sent as `Authorization: Bearer &lt;token>` on every RPC. In an
-  * SSR loader you typically read this from the request (e.g. the session
-  * resolved by `getServerSession`) and pass it here so the server-side
-  * load runs as the signed-in user — and so the client subscription that
-  * resumes after hydration carries the same identity.
-  */
+   * Bearer token sent as `Authorization: Bearer <token>` on every RPC. In an
+   * SSR loader you typically read this from the request (e.g. the session
+   * resolved by `getServerSession`) and pass it here so the server-side
+   * load runs as the signed-in user — and so the client subscription that
+   * resumes after hydration carries the same identity.
+   */
   token?: string;
   /** Base URL of the deployed Lunora worker, e.g. `https://app.example.workers.dev`. */
   url: string;
 }
 /**
-* Build a request-scoped {@link LunoraClient} for use inside an SSR loader. SSR
-* data loading only ever calls `.query()` (HTTP RPC over `fetch`); a
-* `LunoraClient` opens a socket lazily on `.subscribe()`/`.stream()` and those
-* are never called server-side, so no live connection is established even if the
-* server runtime happens to expose a global `WebSocket`.
-*
-* Create one per request rather than sharing a module-level instance: the bearer
-* token (and any forwarded cookies in `fetch`) are per-user, and a shared client
-* would leak one request's identity into another.
-*
-* This is the framework-neutral home of the helper that previously lived only in
-* `@lunora/react/server`; the React server module re-exports the same surface so
-* existing imports keep working.
-*/
+ * Build a request-scoped {@link LunoraClient} for use inside an SSR loader. SSR
+ * data loading only ever calls `.query()` (HTTP RPC over `fetch`); a
+ * `LunoraClient` opens a socket lazily on `.subscribe()`/`.stream()` and those
+ * are never called server-side, so no live connection is established even if the
+ * server runtime happens to expose a global `WebSocket`.
+ *
+ * Create one per request rather than sharing a module-level instance: the bearer
+ * token (and any forwarded cookies in `fetch`) are per-user, and a shared client
+ * would leak one request's identity into another.
+ *
+ * This is the framework-neutral home of the helper that previously lived only in
+ * `@lunora/react/server`; the React server module re-exports the same surface so
+ * existing imports keep working.
+ */
 declare const createServerClient: (options: ServerClientOptions) => LunoraClient;
 export { type AuthLike, type HeadersSource, type Preloaded, type ServerClientOptions, type ServerSession, createServerClient, deserializePreloaded, getServerSession, serializePreloaded };

package/dist/ssr/index.mjs

@@ -1,4 +1 @@
-export { getServerSession } from '../packem_shared/getServerSession-8jXewqxd.mjs';
-export { deserializePreloaded, serializePreloaded } from '../packem_shared/deserializePreloaded-C0eJTY_W.mjs';
-export { createServerClient } from '../packem_shared/createServerClient-DMh-2UDv.mjs';
-export { preloadQuery, preloadedQueryResult } from '../packem_shared/preloadQuery-lobFkD2Z.mjs';
+import{getServerSession as o}from"../packem_shared/getServerSession-CGjgRBAE.mjs";import{deserializePreloaded as l,serializePreloaded as t}from"../packem_shared/deserializePreloaded-CHfOFpka.mjs";import{createServerClient as i}from"../packem_shared/createServerClient-CQf6XOk3.mjs";import{preloadQuery as s,preloadedQueryResult as f}from"../packem_shared/preloadQuery-DjwSjFwt.mjs";export{i as createServerClient,l as deserializePreloaded,o as getServerSession,s as preloadQuery,f as preloadedQueryResult,t as serializePreloaded};

package/dist/upload.d.mts

@@ -0,0 +1,35 @@
+import { UploadControl, HeadersResolver, UploadRestrictions, ChunkedRestAdapter, MultipartAdapter, TusAdapter } from '@visulima/storage-client';
+export { type ChunkedRestAdapter, type ChunkedRestAdapterOptions, type FingerprintFunction, type HeadersResolver, LocalStorageUrlStorage, MemoryUrlStorage, type MultipartAdapter, type MultipartAdapterOptions, type OnBeforeRequest, type RequestOptions, RestrictionError, type TusAdapter, type TusAdapterOptions, type UploadControl, UploadError, type UploadMethod, type UploadRestrictions, type UploadResult, type Uploader, type UrlStorage, createChunkedRestAdapter, createMultipartAdapter, createTusAdapter, putFile, validateFile, validateFiles } from '@visulima/storage-client';
+/** Resumable upload wire protocols {@link createUpload} can drive. */
+type UploadProtocol = "chunked-rest" | "multipart" | "tus";
+/** The adapter shape {@link createUpload} returns — a `.upload(file)` driver plus lifecycle callbacks. */
+type UploadAdapter = ChunkedRestAdapter | MultipartAdapter | TusAdapter;
+/** Options for {@link createUpload}. */
+interface CreateUploadOptions {
+  /** Chunk size in bytes (TUS / chunked-REST only). */
+  chunkSize?: number;
+  /** A shared {@link UploadControl} for pause/resume/cancel (TUS / chunked-REST). */
+  control?: UploadControl;
+  /** The upload endpoint — a route backed by `@lunora/storage/upload`'s handler. */
+  endpoint: string;
+  /** Static or dynamically-resolved request headers (e.g. an `Authorization` token). */
+  headers?: HeadersResolver;
+  /** Maximum retry attempts (TUS / chunked-REST, when `retry` is on). */
+  maxRetries?: number;
+  /** Extra metadata sent with the upload. */
+  metadata?: Record<string, string>;
+  /** Which protocol to speak. Default `"tus"` (resumable, pause/resume-capable). */
+  protocol?: UploadProtocol;
+  /** Client-side size/type restrictions, validated before any network request. */
+  restrictions?: UploadRestrictions;
+  /** Enable automatic retry on failure (TUS / chunked-REST). */
+  retry?: boolean;
+}
+/**
+ * Create a protocol-appropriate upload adapter against an RLS-gated endpoint.
+ * Defaults to TUS — the resumable path that survives pause/resume and a dropped
+ * connection. Call `.upload(file)` to start; use the shared {@link UploadControl}
+ * (or the adapter's `pause`/`resume`/`abort`) to steer it.
+ */
+declare const createUpload: (options: CreateUploadOptions) => UploadAdapter;
+export { CreateUploadOptions, UploadAdapter, UploadProtocol, createUpload };

package/dist/upload.d.ts

@@ -0,0 +1,35 @@
+import { UploadControl, HeadersResolver, UploadRestrictions, ChunkedRestAdapter, MultipartAdapter, TusAdapter } from '@visulima/storage-client';
+export { type ChunkedRestAdapter, type ChunkedRestAdapterOptions, type FingerprintFunction, type HeadersResolver, LocalStorageUrlStorage, MemoryUrlStorage, type MultipartAdapter, type MultipartAdapterOptions, type OnBeforeRequest, type RequestOptions, RestrictionError, type TusAdapter, type TusAdapterOptions, type UploadControl, UploadError, type UploadMethod, type UploadRestrictions, type UploadResult, type Uploader, type UrlStorage, createChunkedRestAdapter, createMultipartAdapter, createTusAdapter, putFile, validateFile, validateFiles } from '@visulima/storage-client';
+/** Resumable upload wire protocols {@link createUpload} can drive. */
+type UploadProtocol = "chunked-rest" | "multipart" | "tus";
+/** The adapter shape {@link createUpload} returns — a `.upload(file)` driver plus lifecycle callbacks. */
+type UploadAdapter = ChunkedRestAdapter | MultipartAdapter | TusAdapter;
+/** Options for {@link createUpload}. */
+interface CreateUploadOptions {
+  /** Chunk size in bytes (TUS / chunked-REST only). */
+  chunkSize?: number;
+  /** A shared {@link UploadControl} for pause/resume/cancel (TUS / chunked-REST). */
+  control?: UploadControl;
+  /** The upload endpoint — a route backed by `@lunora/storage/upload`'s handler. */
+  endpoint: string;
+  /** Static or dynamically-resolved request headers (e.g. an `Authorization` token). */
+  headers?: HeadersResolver;
+  /** Maximum retry attempts (TUS / chunked-REST, when `retry` is on). */
+  maxRetries?: number;
+  /** Extra metadata sent with the upload. */
+  metadata?: Record<string, string>;
+  /** Which protocol to speak. Default `"tus"` (resumable, pause/resume-capable). */
+  protocol?: UploadProtocol;
+  /** Client-side size/type restrictions, validated before any network request. */
+  restrictions?: UploadRestrictions;
+  /** Enable automatic retry on failure (TUS / chunked-REST). */
+  retry?: boolean;
+}
+/**
+ * Create a protocol-appropriate upload adapter against an RLS-gated endpoint.
+ * Defaults to TUS — the resumable path that survives pause/resume and a dropped
+ * connection. Call `.upload(file)` to start; use the shared {@link UploadControl}
+ * (or the adapter's `pause`/`resume`/`abort`) to steer it.
+ */
+declare const createUpload: (options: CreateUploadOptions) => UploadAdapter;
+export { CreateUploadOptions, UploadAdapter, UploadProtocol, createUpload };

package/dist/upload.mjs

@@ -0,0 +1 @@
+import{createMultipartAdapter as l,createChunkedRestAdapter as u,createTusAdapter as m}from"@visulima/storage-client";import{LocalStorageUrlStorage as x,MemoryUrlStorage as S,RestrictionError as U,UploadControl as y,UploadError as f,createChunkedRestAdapter as g,createMultipartAdapter as C,createTusAdapter as F,putFile as M,validateFile as v,validateFiles as z}from"@visulima/storage-client";const A=e=>{const t=e.protocol??"tus",{chunkSize:c,control:p,endpoint:r,headers:a,maxRetries:o,metadata:i,restrictions:d,retry:n}=e;if(t==="multipart")return l({endpoint:r,headers:a,maxRetries:o,metadata:i,restrictions:d,retry:n});const s={chunkSize:c,control:p,endpoint:r,headers:a,maxRetries:o,metadata:i,restrictions:d,retry:n};return t==="chunked-rest"?u(s):m(s)};export{x as LocalStorageUrlStorage,S as MemoryUrlStorage,U as RestrictionError,y as UploadControl,f as UploadError,g as createChunkedRestAdapter,C as createMultipartAdapter,F as createTusAdapter,A as createUpload,M as putFile,v as validateFile,z as validateFiles};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/client",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.40",
   "description": "Lunora browser SDK: WebSocket transport, optimistic updates, and an offline mutation queue",
   "keywords": [
     "cloudflare",
@@ -56,11 +56,23 @@
       "types": "./dist/ssr/index.d.ts",
       "import": "./dist/ssr/index.mjs"
     },
+    "./upload": {
+      "types": "./dist/upload.d.ts",
+      "import": "./dist/upload.mjs"
+    },
+    "./service": {
+      "types": "./dist/service.d.ts",
+      "import": "./dist/service.mjs"
+    },
     "./package.json": "./package.json"
   },
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@lunora/errors": "1.0.0-alpha.14",
+    "@visulima/storage-client": "1.0.0"
+  },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"
   }

package/dist/packem_shared/CONFLICT_ERROR_CODE-aUdVbEDw.mjs

@@ -1,4 +0,0 @@
-const CONFLICT_ERROR_CODE = "CONFLICT";
-const isConflictError = (error) => error instanceof Error && error.code === CONFLICT_ERROR_CODE;
-
-export { CONFLICT_ERROR_CODE, isConflictError };

package/dist/packem_shared/DEFAULT_MAX_BUFFER-BDkqO5PW.mjs

@@ -1,107 +0,0 @@
-const DEFAULT_MAX_BUFFER = 1024;
-const createStream = (options) => {
-  const maxBuffer = options.maxBuffer ?? DEFAULT_MAX_BUFFER;
-  const buffer = [];
-  const pending = [];
-  let done = false;
-  let failure;
-  let cancelled = false;
-  const flushOne = () => {
-    const waiter = pending.shift();
-    if (!waiter) {
-      return false;
-    }
-    if (failure) {
-      waiter.reject(failure);
-      return true;
-    }
-    if (buffer.length > 0) {
-      const value = buffer.shift();
-      waiter.resolve({ done: false, value });
-      return true;
-    }
-    if (done) {
-      waiter.resolve({ done: true, value: void 0 });
-      return true;
-    }
-    pending.unshift(waiter);
-    return false;
-  };
-  const handle = {
-    complete() {
-      if (done || failure) {
-        return;
-      }
-      done = true;
-      while (flushOne()) {
-      }
-    },
-    fail(error) {
-      if (done || failure) {
-        return;
-      }
-      failure = error;
-      buffer.length = 0;
-      while (flushOne()) {
-      }
-    },
-    push(value) {
-      if (done || failure || cancelled) {
-        return;
-      }
-      if (buffer.length >= maxBuffer) {
-        handle.fail(
-          Object.assign(new Error(`stream buffer overflow (max=${maxBuffer.toString()}); the consumer cannot keep up with the producer`), {
-            code: "STREAM_BACKPRESSURE"
-          })
-        );
-        return;
-      }
-      buffer.push(value);
-      flushOne();
-    }
-  };
-  const cancel = () => {
-    if (cancelled) {
-      return;
-    }
-    cancelled = true;
-    done = true;
-    buffer.length = 0;
-    try {
-      options.onCancel();
-    } catch {
-    }
-    while (flushOne()) {
-    }
-  };
-  const iterable = {
-    cancel,
-    [Symbol.asyncIterator]() {
-      return {
-        next() {
-          if (failure) {
-            return Promise.reject(failure);
-          }
-          if (buffer.length > 0) {
-            const value = buffer.shift();
-            return Promise.resolve({ done: false, value });
-          }
-          if (done) {
-            return Promise.resolve({ done: true, value: void 0 });
-          }
-          return new Promise((resolve, reject) => {
-            pending.push({ reject, resolve });
-          });
-        },
-        return() {
-          cancel();
-          return Promise.resolve({ done: true, value: void 0 });
-        }
-      };
-    }
-  };
-  return { handle, iterable };
-};
-
-export { DEFAULT_MAX_BUFFER, createStream };