@lunora/codegen 1.0.0-alpha.22 → 1.0.0-alpha.24

package/dist/index.d.mts

@@ -258,6 +258,19 @@ interface ShapeIR {
   table?: string;
 }
 /**
+* The single `defineIdentity({...})` claim contract discovered in
+* `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+* brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+* because the emitted `_generated/server.ts` recovers the claim *type* from the
+* declaration itself (`InferIdentity` over the contract's `typeof`), and the
+* runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+* Exactly one per app; absent ⇒ generated output is byte-identical to today.
+*/
+interface IdentityIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
+}
+/**
 * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
 * (local-first sync engine, Phase 7). The emitted registry registers the
 * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
@@ -1180,6 +1193,15 @@ interface EmitServerOptions {
   hasPipelines?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
   hasR2sql?: boolean;
+  /**
+  * The single `defineIdentity(...)` claim contract declared in
+  * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
+  * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
+  * narrow to the declared shape (recovered via `InferIdentity` over the
+  * contract's `typeof`). `undefined` keeps the identity an untyped bag —
+  * byte-identical to today.
+  */
+  identity?: IdentityIR;
   /** Queues declared via `defineQueue` exports — wires the typed `ctx.queues` producers onto Mutation/Action contexts. */
   queues?: ReadonlyArray<QueueIR>;
   schema?: SchemaIR;
@@ -1201,6 +1223,7 @@ declare const emitServer: ({
   hasPayments,
   hasPipelines,
   hasR2sql,
+  identity,
   queues,
   schema,
   storageRuleBuckets,
@@ -1407,6 +1430,8 @@ interface EmitAppOptions {
   hasVectors: boolean;
   /** App declares Cloudflare Workflows (`defineWorkflow`) → wire `options.workflowsClient` so the studio's workflow-instance proxy can reach the CF REST API. */
   hasWorkflow: boolean;
+  /** The single `defineIdentity(...)` contract in `lunora/identity.ts` (Plan 080) → import it as a VALUE and wire `options.identity`, so the runtime trust boundary validates every resolved identity before it becomes `ctx.auth`. `undefined` ⇒ no wiring, byte-identical output. */
+  identity?: IdentityIR;
   /** Schema declares `.jurisdiction("…")` → pin every DO the worker reaches (shards, fan-out, scheduler, containers) to the Cloudflare data-residency jurisdiction. */
   jurisdiction?: JurisdictionIR;
   /** Project depends on the unscoped `lunorash` umbrella → import the runtime via `lunorash/runtime` instead of `@lunora/runtime`. */

package/dist/index.d.ts

@@ -258,6 +258,19 @@ interface ShapeIR {
   table?: string;
 }
 /**
+* The single `defineIdentity({...})` claim contract discovered in
+* `lunora/identity.ts`. Discovery is **marker-driven** (the `__lunoraIdentity`
+* brand, exactly like {@link ShapeIR}) — no claim metadata is lifted here
+* because the emitted `_generated/server.ts` recovers the claim *type* from the
+* declaration itself (`InferIdentity` over the contract's `typeof`), and the
+* runtime object (`validate`/`onInvalid`) carries the authority at the boundary.
+* Exactly one per app; absent ⇒ generated output is byte-identical to today.
+*/
+interface IdentityIR {
+  /** Export binding name — the namespace member `_generated/server.ts` reads via `typeof`. */
+  exportName: string;
+}
+/**
 * A `defineMutator({...})` declaration discovered in `lunora/mutators.ts`
 * (local-first sync engine, Phase 7). The emitted registry registers the
 * authoritative `server` impl into the DO's `LUNORA_FUNCTIONS` table (so
@@ -1180,6 +1193,15 @@ interface EmitServerOptions {
   hasPipelines?: boolean;
   /** A `lunora/` source uses `@lunora/bindings/r2sql` / `ctx.r2sql` — wires `ctx.r2sql` onto ActionCtx only. */
   hasR2sql?: boolean;
+  /**
+  * The single `defineIdentity(...)` claim contract declared in
+  * `lunora/identity.ts` (Plan 080). When present, `ctx.auth.getIdentity()`,
+  * the RLS policy `ctx.auth.identity`, and the shard-authorization hooks
+  * narrow to the declared shape (recovered via `InferIdentity` over the
+  * contract's `typeof`). `undefined` keeps the identity an untyped bag —
+  * byte-identical to today.
+  */
+  identity?: IdentityIR;
   /** Queues declared via `defineQueue` exports — wires the typed `ctx.queues` producers onto Mutation/Action contexts. */
   queues?: ReadonlyArray<QueueIR>;
   schema?: SchemaIR;
@@ -1201,6 +1223,7 @@ declare const emitServer: ({
   hasPayments,
   hasPipelines,
   hasR2sql,
+  identity,
   queues,
   schema,
   storageRuleBuckets,
@@ -1407,6 +1430,8 @@ interface EmitAppOptions {
   hasVectors: boolean;
   /** App declares Cloudflare Workflows (`defineWorkflow`) → wire `options.workflowsClient` so the studio's workflow-instance proxy can reach the CF REST API. */
   hasWorkflow: boolean;
+  /** The single `defineIdentity(...)` contract in `lunora/identity.ts` (Plan 080) → import it as a VALUE and wire `options.identity`, so the runtime trust boundary validates every resolved identity before it becomes `ctx.auth`. `undefined` ⇒ no wiring, byte-identical output. */
+  identity?: IdentityIR;
   /** Schema declares `.jurisdiction("…")` → pin every DO the worker reaches (shards, fan-out, scheduler, containers) to the Cloudflare data-residency jurisdiction. */
   jurisdiction?: JurisdictionIR;
   /** Project depends on the unscoped `lunorash` umbrella → import the runtime via `lunorash/runtime` instead of `@lunora/runtime`. */

package/dist/index.mjs

@@ -19,11 +19,11 @@ export { default as discoverSchema } from './packem_shared/discoverSchema-KYq55q
 export { SHAPES_FILENAME, discoverShapes } from './packem_shared/SHAPES_FILENAME-ChV7MqgE.mjs';
 export { default as discoverStorageRulesMetadata } from './packem_shared/discoverStorageRulesMetadata-Da8BKXcI.mjs';
 export { WORKFLOWS_FILENAME, discoverWorkflows } from './packem_shared/WORKFLOWS_FILENAME-CCisG0Vy.mjs';
-export { GENERATED_HEADER, emitApi, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/GENERATED_HEADER-CI272wRm.mjs';
-export { emitApp } from './packem_shared/emitApp-cOSypPuO.mjs';
-export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-Dx5QftUn.mjs';
-export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-t5pV2NIN.mjs';
-export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-BMez-jgr.mjs';
+export { GENERATED_HEADER, emitApi, emitCollections, emitContainers, emitCrons, emitDataModel, emitDrizzleSchema, emitFunctions, emitServer, emitShard, emitVectors, emitWorkflows, emitWranglerCronTriggers } from './packem_shared/GENERATED_HEADER-DUkXYD5R.mjs';
+export { emitApp } from './packem_shared/emitApp-DD0i1ks0.mjs';
+export { buildOpenApiDocument, emitOpenApi, emitOpenApiModule } from './packem_shared/buildOpenApiDocument-WxYTLh11.mjs';
+export { OPENRPC_VERSION, buildOpenRpcDocument, emitOpenRpc, emitOpenRpcModule } from './packem_shared/OPENRPC_VERSION-CjBUaolx.mjs';
+export { SCHEMA_SNAPSHOT_FILENAME, createCodegenProject, refreshCodegenProject, runCodegen } from './packem_shared/SCHEMA_SNAPSHOT_FILENAME-BUcGCXi3.mjs';
 export { SCHEMA_SNAPSHOT_VERSION, SchemaSnapshotParseError, buildSchemaSnapshot, diffSchemaSnapshots, evaluateSchemaDrift, parseSchemaSnapshot, serializeSchemaSnapshot } from './packem_shared/SCHEMA_SNAPSHOT_VERSION-wWGP2_5E.mjs';
 export { schemaFromIr } from './packem_shared/schemaFromIr-DTYsLBaA.mjs';
 export { LUNORA_ERROR_CODES, validatorIrToJsonSchema } from './packem_shared/LUNORA_ERROR_CODES-CySpQPD3.mjs';

package/dist/packem_shared/{GENERATED_HEADER-CI272wRm.mjs → GENERATED_HEADER-DUkXYD5R.mjs}

@@ -760,6 +760,7 @@ const emitServer = ({
   hasPayments = false,
   hasPipelines = false,
   hasR2sql = false,
+  identity,
   queues = [],
   schema,
   storageRuleBuckets = [],
@@ -885,6 +886,20 @@ ${queues.map((queue) => `    readonly ${queue.exportName}: QueueProducer<QueueBo
 }` : "";
   const queuesContextField = hasQueues ? `
     readonly queues: LunoraQueues;` : "";
+  const identityTypeImport = identity ? `import type { InferIdentity } from "${base.server}";
+import type * as lunoraIdentityContract from "../identity.js";
+` : "";
+  const identityTypeBlock = identity ? `
+
+/** This app's declared identity claim contract (\`defineIdentity\` in \`lunora/identity.ts\`) — the typed shape of \`ctx.auth.getIdentity()\`, the RLS policy \`ctx.auth.identity\`, and the \`authorizeShard\`/\`authorizeFanOut\` identity argument. */
+export type Identity = InferIdentity<typeof lunoraIdentityContract.${identity.exportName}>;
+
+/** \`ctx.auth\` narrowed so \`getIdentity()\` resolves the declared {@link Identity} contract instead of the untyped claim bag. */
+type NarrowedAuth = Omit<QueryCtxBase["auth"], "getIdentity"> & { getIdentity: () => Promise<Identity | null> };` : "";
+  const authOmit = identity ? ` | "auth"` : "";
+  const authContextField = identity ? `
+    readonly auth: NarrowedAuth;` : "";
+  const policyIdentityArgument = identity ? ", Identity" : "";
   const server = `${GENERATED_HEADER}import { createPolicyDsl, initLunora, v as vBase } from "${base.server}";
 import type {
     ActionBuilder,
@@ -906,11 +921,11 @@ import type {
 } from "${base.server}";
 
 import type { DataModel, DatabaseReaderFacade, DatabaseWriterFacade, Doc, Id as IdOfTable, OrmReader, OrmWriter, Relations, TableName } from "./dataModel.js";
-${aiTypeImport}${paymentsTypeImport}${containersTypeImport}${workflowsTypeImport}${queuesTypeImport}
+${aiTypeImport}${paymentsTypeImport}${containersTypeImport}${workflowsTypeImport}${queuesTypeImport}${identityTypeImport}
 export type { DataModel, Doc, Id, TableName } from "./dataModel.js";
 
 /** Storage buckets this schema declares (\`v.storage("name")\`), narrowing \`ctx.storage.bucket(name)\`. */
-export type StorageBucketName = ${storageBucketUnion};${envBlock}${workflowsTypeBlock}${queuesTypeBlock}
+export type StorageBucketName = ${storageBucketUnion};${envBlock}${workflowsTypeBlock}${queuesTypeBlock}${identityTypeBlock}
 
 /**
  * Project-typed contexts. The base contexts from \`@lunora/server\` are
@@ -939,22 +954,22 @@ type TypedTableQuery = (<T extends TableName>(table: T) => TableReader<Doc<T>>)
  */
 type TypedTableGet = <T extends TableName>(id: IdOfTable<T>) => Promise<Doc<T> | null>;
 
-export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"> {
+export interface QueryCtx extends Omit<QueryCtxBase, "db" | "storage"${authOmit}> {
     readonly db: Omit<DatabaseReader, "query" | "get"> & DatabaseReaderFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmReader;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}${authContextField}
 }
 
-export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${workflowsOmit}> {
+export interface MutationCtx extends Omit<MutationCtxBase, "db" | "storage"${workflowsOmit}${authOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}${workflowsContextField}${queuesContextField}
+    readonly storage: ReadOnlyStorage<StorageBucketName>;${accessContextField}${kvContextField}${flagsContextField}${analyticsContextField}${workflowsContextField}${queuesContextField}${authContextField}
 }
 
-export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${workflowsOmit}> {
+export interface ActionCtx extends Omit<ActionCtxBase, "db" | "storage"${workflowsOmit}${authOmit}> {
     readonly db: Omit<DatabaseWriter, "query" | "get"> & DatabaseWriterFacade & { query: TypedTableQuery; get: TypedTableGet };
     readonly orm: OrmWriter;
-    readonly storage: StorageBase<StorageBucketName>;${accessContextField}${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${flagsContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}${queuesContextField}
+    readonly storage: StorageBase<StorageBucketName>;${accessContextField}${aiActionField}${paymentsActionField}${containersActionField}${kvContextField}${flagsContextField}${hyperdriveActionField}${browserActionField}${imagesActionField}${analyticsContextField}${pipelinesActionField}${r2sqlActionField}${workflowsContextField}${queuesContextField}${authContextField}
 }
 
 /**
@@ -994,7 +1009,7 @@ export const internalAction = lunoraBuilders.internalAction as unknown as Intern
  * Runtime-identical to \`@lunora/server\`'s \`definePolicy\`; only the types narrow,
  * so the \`rls()\` chain discovers a policy authored either way the same.
  */
-export const definePolicy = createPolicyDsl<DataModel, Relations>();
+export const definePolicy = createPolicyDsl<DataModel, Relations${policyIdentityArgument}>();
 
 /**
  * The validator builder \`v\`, with \`v.id(...)\` constrained to THIS schema's

package/dist/packem_shared/{OPENRPC_VERSION-t5pV2NIN.mjs → OPENRPC_VERSION-CjBUaolx.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-CI272wRm.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DUkXYD5R.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { argsObjectSchema, LUNORA_ERROR_CODES } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{SCHEMA_SNAPSHOT_FILENAME-BMez-jgr.mjs → SCHEMA_SNAPSHOT_FILENAME-BUcGCXi3.mjs}

@@ -9,6 +9,7 @@ import { discoverContainers } from './CONTAINERS_FILENAME-DlP6YM_Q.mjs';
 import discoverCrons from './discoverCrons-Cev7RRAf.mjs';
 import { discoverFlagKeys } from './FLAGS_FILENAME-B1vE0LIo.mjs';
 import discoverHttpRoutes from './discoverHttpRoutes-CfP6cMzt.mjs';
+import { diagnosticAt } from './CodegenDiagnosticError-DeblMkzO.mjs';
 import discoverInserts from './discoverInserts-C7zxXkUf.mjs';
 import discoverMaskProcedures, { discoverMaskMetadata } from './discoverMaskProcedures-Cm81kwrb.mjs';
 import discoverMigrations from './discoverMigrations-Bi5nJ0mJ.mjs';
@@ -23,10 +24,10 @@ import { discoverShapes } from './SHAPES_FILENAME-ChV7MqgE.mjs';
 import discoverStorageRulesMetadata from './discoverStorageRulesMetadata-Da8BKXcI.mjs';
 import { e as enclosingExportName$1 } from './discover-ast-CT6BgBr4.mjs';
 import { discoverWorkflows } from './WORKFLOWS_FILENAME-CCisG0Vy.mjs';
-import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitCollections, emitContainers, emitWorkflows, emitQueues, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-CI272wRm.mjs';
-import { emitApp } from './emitApp-cOSypPuO.mjs';
-import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-Dx5QftUn.mjs';
-import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-t5pV2NIN.mjs';
+import { buildStorageColumns, emitDataModel, emitApi, emitServer, emitFunctions, emitShard, emitCollections, emitContainers, emitWorkflows, emitQueues, emitCrons, emitVectors, emitDrizzleSchema, emitSeed, emitWranglerCronTriggers } from './GENERATED_HEADER-DUkXYD5R.mjs';
+import { emitApp } from './emitApp-DD0i1ks0.mjs';
+import { buildOpenApiDocument, emitOpenApiModule } from './buildOpenApiDocument-WxYTLh11.mjs';
+import { buildOpenRpcDocument, emitOpenRpcModule } from './OPENRPC_VERSION-CjBUaolx.mjs';
 import { buildSchemaSnapshot, serializeSchemaSnapshot } from './SCHEMA_SNAPSHOT_VERSION-wWGP2_5E.mjs';
 
 const HTTP_VERBS = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put"]);
@@ -337,6 +338,89 @@ const buildStudioFeatures = (usage, signals) => {
   };
 };
 
+const IDENTITY_FILENAME = "identity.ts";
+const IDENTITY_MODULE_SPECIFIERS = /* @__PURE__ */ new Set(["@lunora/server", "lunorash/server"]);
+const isDefineIdentity = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return identifier.getText() === "defineIdentity";
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isImportSpecifier(declaration)) {
+      continue;
+    }
+    if (!IDENTITY_MODULE_SPECIFIERS.has(declaration.getImportDeclaration().getModuleSpecifierValue())) {
+      return false;
+    }
+    return declaration.getNameNode().getText() === "defineIdentity";
+  }
+  return false;
+};
+const isIdentityNamespaceImport = (identifier) => {
+  const symbol = identifier.getSymbol();
+  if (!symbol) {
+    return false;
+  }
+  for (const declaration of symbol.getDeclarations()) {
+    if (!Node.isNamespaceImport(declaration)) {
+      continue;
+    }
+    const importDeclaration = declaration.getFirstAncestorByKind(SyntaxKind.ImportDeclaration);
+    return importDeclaration !== void 0 && IDENTITY_MODULE_SPECIFIERS.has(importDeclaration.getModuleSpecifierValue());
+  }
+  return false;
+};
+const isDefineIdentityCallee = (callee) => {
+  if (Node.isIdentifier(callee)) {
+    return isDefineIdentity(callee);
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    const object = callee.getExpression();
+    return callee.getName() === "defineIdentity" && Node.isIdentifier(object) && isIdentityNamespaceImport(object);
+  }
+  return false;
+};
+const identitiesFromSource = (source) => {
+  const identities = [];
+  for (const declaration of source.getVariableDeclarations()) {
+    if (!declaration.isExported()) {
+      continue;
+    }
+    const initializer = declaration.getInitializer();
+    if (initializer?.getKind() !== SyntaxKind.CallExpression) {
+      continue;
+    }
+    const callExpression = initializer;
+    if (!isDefineIdentityCallee(callExpression.getExpression())) {
+      continue;
+    }
+    const nameNode = declaration.getNameNode();
+    if (!Node.isIdentifier(nameNode)) {
+      throw diagnosticAt(nameNode, "defineIdentity exports must be plain named exports (no destructuring)");
+    }
+    identities.push({ exportName: nameNode.getText() });
+  }
+  return identities;
+};
+const discoverIdentity = (project, lunoraDirectory) => {
+  const identityPath = join(lunoraDirectory, IDENTITY_FILENAME);
+  if (!existsSync(identityPath)) {
+    return void 0;
+  }
+  const source = project.getSourceFile(identityPath) ?? project.addSourceFileAtPath(identityPath);
+  const identities = identitiesFromSource(source);
+  if (identities.length === 0) {
+    return void 0;
+  }
+  if (identities.length > 1) {
+    throw diagnosticAt(
+      source,
+      `lunora/identity.ts declares ${identities.length.toString()} defineIdentity() contracts (${identities.map((identity) => identity.exportName).join(", ")}); exactly one is allowed`
+    );
+  }
+  return identities[0];
+};
+
 const isDatabaseReplaceCall = (call) => {
   const callee = call.getExpression();
   if (!Node.isPropertyAccessExpression(callee) || callee.getName() !== "replace") {
@@ -808,6 +892,7 @@ const runCodegen = (options) => {
   const migrations = discoverMigrations(project, lunoraDirectory);
   const shapes = discoverShapes(project, lunoraDirectory);
   const mutators = discoverMutators(project, lunoraDirectory);
+  const identity = discoverIdentity(project, lunoraDirectory);
   const workflows = discoverWorkflows(project, lunoraDirectory);
   const queues = discoverQueues(project, lunoraDirectory);
   const crons = discoverCrons(project, lunoraDirectory, workflows);
@@ -875,6 +960,7 @@ const runCodegen = (options) => {
     hasPayments,
     hasPipelines,
     hasR2sql,
+    identity,
     queues,
     schema,
     storageRuleBuckets: storageRulesMetadata.rules.map((rule) => rule.bucket),
@@ -943,6 +1029,11 @@ const runCodegen = (options) => {
     hasStorage: studioFeatures.storage,
     hasVectors: schema.vectorIndexes.length > 0,
     hasWorkflow: workflows.length > 0,
+    // The single `defineIdentity(...)` contract (Plan 080). Wires
+    // `options.identity` so the runtime trust boundary validates every
+    // resolved identity before it becomes `ctx.auth`; `undefined` keeps the
+    // emitted app.ts byte-identical to before this feature.
+    identity,
     // Schema `.jurisdiction("…")` → pin the generated worker's DOs to the region.
     jurisdiction: schema.jurisdiction,
     useUmbrella,

package/dist/packem_shared/{buildOpenApiDocument-Dx5QftUn.mjs → buildOpenApiDocument-WxYTLh11.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-CI272wRm.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DUkXYD5R.mjs';
 import { s as sanitizeNamespace } from './paths-BRd6JHuF.mjs';
 import { LUNORA_ERROR_CODES, objectSchema, argsObjectSchema, validatorIrToJsonSchema } from './LUNORA_ERROR_CODES-CySpQPD3.mjs';
 

package/dist/packem_shared/{emitApp-cOSypPuO.mjs → emitApp-DD0i1ks0.mjs}

@@ -1,4 +1,4 @@
-import { GENERATED_HEADER } from './GENERATED_HEADER-CI272wRm.mjs';
+import { GENERATED_HEADER } from './GENERATED_HEADER-DUkXYD5R.mjs';
 
 const LONG_TAIL = [
   ["hasAi", "ai", "ai", "Override the Workers AI binding backing `ctx.ai` (defaults to `env.AI`)."],
@@ -22,6 +22,7 @@ const LONG_TAIL = [
   ["hasVectors", "vectors", "vectors", "Wire the Vectorize index map backing `ctx.vectors`."]
 ];
 const hasAnyLongTail = (options) => LONG_TAIL.some(([flag]) => options[flag]);
+const buildIdentityImports = (identity) => identity ? [`import * as lunoraIdentityContract from "../identity.js";`] : [];
 const buildAccessImports = (hasAccess, hasAuth) => hasAccess ? [
   `import type { CreateAccessResolverOptions } from "@lunora/cloudflare-access";`,
   `import { createAccessResolver${hasAuth ? ", composeResolvers" : ""} } from "@lunora/cloudflare-access";`
@@ -75,6 +76,7 @@ const buildImportLines = (options) => {
     `import type { ${[...runtimeTypeImports].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from "${runtimeModule}";`,
     `import { ${runtimeValueImports} } from "${runtimeModule}";`,
     ``,
+    ...buildIdentityImports(options.identity),
     ...hasGlobal || hasHyperdriveGlobal ? [`import schema from "../schema.js";`] : [],
     `import { LUNORA_CRONS } from "./crons.js";`,
     `import { LUNORA_FUNCTIONS } from "./functions.js";`,
@@ -391,6 +393,11 @@ const buildWorkerOptionLines = (options) => [
 const buildBaseWorkerOptions = (options) => [
   `            cronJobs: LUNORA_CRONS,`,
   `            functions: LUNORA_FUNCTIONS,`,
+  // The declared `defineIdentity(...)` contract — wires the runtime trust
+  // boundary so `wrapResolverWithContract` validates every resolved identity
+  // against it before it becomes `ctx.auth`. Emitted only when the app declares
+  // a contract, so apps without one keep unchanged output.
+  ...options.identity ? [`            identity: lunoraIdentityContract.${options.identity.exportName},`] : [],
   // Schema `.jurisdiction("…")` pins every DO the worker reaches to the
   // Cloudflare data-residency region. Emitted only when declared, so apps
   // without it keep the un-pinned global namespace (and unchanged output).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/codegen",
-  "version": "1.0.0-alpha.22",
+  "version": "1.0.0-alpha.24",
   "description": "Code generator for Lunora: emits _generated/{api,server,dataModel}.ts from your schema",
   "keywords": [
     "cloudflare",
@@ -46,12 +46,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/advisor": "1.0.0-alpha.12",
+    "@lunora/advisor": "1.0.0-alpha.13",
     "@lunora/container": "1.0.0-alpha.5",
     "@lunora/queue": "1.0.0-alpha.1",
     "@lunora/scheduler": "1.0.0-alpha.4",
     "@lunora/values": "1.0.0-alpha.3",
-    "@lunora/workflow": "1.0.0-alpha.4",
+    "@lunora/workflow": "1.0.0-alpha.5",
     "ts-morph": "^28.0.0"
   },
   "engines": {