@lunora/do 0.0.0 → 1.0.0-alpha.1

package/dist/packem_shared/rank-CrkEIpF4.mjs

@@ -0,0 +1,102 @@
+const serializeSqlValue = (value) => {
+  if (typeof value === "boolean") {
+    return value ? 1 : 0;
+  }
+  if (value === null || typeof value === "string" || typeof value === "number") {
+    return value;
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return JSON.stringify(value);
+};
+
+const compareStrings = (a, b) => {
+  if (a < b) {
+    return -1;
+  }
+  return a > b ? 1 : 0;
+};
+const NOT_RESOLVABLE = /* @__PURE__ */ Symbol("not-resolvable");
+const resolvePartitionValue = (value) => {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    const operatorKeys = Object.keys(value);
+    if (operatorKeys.length === 1 && operatorKeys[0] === "eq") {
+      return value.eq;
+    }
+    return NOT_RESOLVABLE;
+  }
+  return value;
+};
+const encodePartitionKey = (partitionBy, source) => {
+  if (partitionBy.length === 0) {
+    return "";
+  }
+  const ordered = {};
+  for (const field of [...partitionBy].toSorted(compareStrings)) {
+    ordered[field] = source[field] ?? null;
+  }
+  return JSON.stringify(ordered);
+};
+const RANK_TIEBREAK = "__id__";
+const sortColumnName = (i) => `__sort_k${String(i)}__`;
+const matchesRankStaticWhere = (document, predicate) => {
+  for (const [field, expected] of Object.entries(predicate)) {
+    const actual = document[field];
+    if (expected !== null && typeof expected === "object" && !Array.isArray(expected)) {
+      const operatorKeys = Object.keys(expected);
+      if (operatorKeys.length === 1 && operatorKeys[0] === "eq") {
+        if (actual !== expected.eq) {
+          return false;
+        }
+        continue;
+      }
+      return false;
+    }
+    if (actual !== expected) {
+      return false;
+    }
+  }
+  return true;
+};
+const resolveRankPartition = (index, where) => {
+  const partitionBy = index.partitionBy ?? [];
+  const requested = where ?? {};
+  for (const key of Object.keys(requested)) {
+    if (key === "AND" || key === "OR" || key === "NOT") {
+      return void 0;
+    }
+  }
+  const resolved = {};
+  for (const field of partitionBy) {
+    if (field in requested) {
+      const value = resolvePartitionValue(requested[field]);
+      if (value === NOT_RESOLVABLE) {
+        return void 0;
+      }
+      resolved[field] = value;
+    } else if (index.where && field in index.where) {
+      resolved[field] = index.where[field];
+    } else {
+      return void 0;
+    }
+  }
+  return resolved;
+};
+const rankTableName = (table, indexName) => `${table}__rank_${indexName}`;
+const rankKeyFromDocument = (index, document_) => {
+  return {
+    partitionKey: encodePartitionKey(index.partitionBy ?? [], document_),
+    rowId: document_["_id"],
+    // Serialize each sort value the same way `syncRankIndexEntry` writes the
+    // stored `__sort_k<i>__` column, so a peer shard's comparison matches
+    // byte-for-byte. This also makes the values JSON-safe for the
+    // cross-shard RPC wire — `serializeSqlValue` turns bigint/Date/object
+    // into a string|number|null, where raw bigint would crash JSON.stringify
+    // and a raw Date would serialize to a different shape than the store.
+    // eslint-disable-next-line unicorn/no-null -- mirrors syncRankIndexEntry: a missing field serializes via `?? null` so the stored and wire bytes agree
+    sortValues: index.sortBy.map((key) => serializeSqlValue(document_[key.field] ?? null))
+  };
+};
+
+export { RANK_TIEBREAK as R, resolveRankPartition as a, serializeSqlValue as b, rankKeyFromDocument as c, encodePartitionKey as e, matchesRankStaticWhere as m, rankTableName as r, sortColumnName as s };

package/dist/packem_shared/renderSql-D6eUcn2N.mjs

@@ -0,0 +1,16 @@
+import { sql } from 'drizzle-orm';
+import { MySqlDialect } from 'drizzle-orm/mysql-core';
+import { PgDialect } from 'drizzle-orm/pg-core';
+import { SQLiteSyncDialect } from 'drizzle-orm/sqlite-core';
+
+const PG_DIALECT = new PgDialect();
+const MYSQL_DIALECT = new MySqlDialect();
+const SQLITE_DIALECT = new SQLiteSyncDialect();
+const DIALECTS = { mysql: MYSQL_DIALECT, postgres: PG_DIALECT, sqlite: SQLITE_DIALECT };
+const renderSql = (engine, query) => {
+  const { params, sql: text } = DIALECTS[engine].sqlToQuery(query);
+  return { params, sql: text };
+};
+const param = (value) => sql`${value}`;
+
+export { param, renderSql };

package/dist/packem_shared/runShardMigrations-C3bn5r93.mjs

@@ -0,0 +1,103 @@
+import { sql } from 'drizzle-orm';
+import { aggregateTableName } from './aggregateTableName-CxNqY1Sl.mjs';
+import { migrateCdcLog, migrateCdcMeta } from './applyCdcChanges-Ctdmxmrv.mjs';
+import { m as migrateIdempotency } from './ctx-db-idempotency-DkC9rP91.mjs';
+import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
+import { D as DOC_COLUMN, j as jsonPathSql, c as createIndexSql, t as tableColumns, i as isFtsAvailable, A as AGG_KEY, a as AGG_VALUE, b as AGG_COUNT } from './do-sql-BCHCWtrD.mjs';
+import { s as sortColumnName, r as rankTableName } from './rank-CrkEIpF4.mjs';
+import { ftsTableName } from './ftsTableName-BLEMawrp.mjs';
+
+const migrateSecondaryIndexes = (sql$1, tableName, definition) => {
+  for (const index of definition.indexes) {
+    const indexName = `${tableName}_${index.name}`;
+    const expressions = sql.join(
+      index.fields.map((field) => jsonPathSql(field)),
+      sql`, `
+    );
+    runDrizzle(sql$1, createIndexSql(indexName, tableName, expressions, index.unique ?? false));
+  }
+  for (const [field, column] of tableColumns(definition)) {
+    if (!column.unique) {
+      continue;
+    }
+    const indexName = `${tableName}_unique_${field}`;
+    runDrizzle(sql$1, createIndexSql(indexName, tableName, jsonPathSql(field), true));
+  }
+};
+const migrateSearchIndexes = (sql$1, tableName, definition) => {
+  if (!definition.searchIndexes || definition.searchIndexes.length === 0 || !isFtsAvailable(sql$1)) {
+    return;
+  }
+  for (const index of definition.searchIndexes) {
+    const ftName = ftsTableName(tableName, index.name);
+    runDrizzle(
+      sql$1,
+      sql`CREATE VIRTUAL TABLE IF NOT EXISTS ${sql.identifier(ftName)} USING fts5(${sql.identifier("__text__")}, ${sql.identifier("__id__")} UNINDEXED)`
+    );
+  }
+};
+const migrateAggregateIndexes = (sql$1, tableName, definition) => {
+  if (!definition.aggregateIndexes) {
+    return;
+  }
+  for (const index of definition.aggregateIndexes) {
+    const aggTable = aggregateTableName(tableName, index.name);
+    runDrizzle(
+      sql$1,
+      sql`CREATE TABLE IF NOT EXISTS ${sql.identifier(aggTable)} (${AGG_KEY} TEXT PRIMARY KEY, ${AGG_VALUE} REAL, ${AGG_COUNT} INTEGER NOT NULL DEFAULT 0)`
+    );
+    const columns = runDrizzle(sql$1, sql`PRAGMA table_info(${sql.identifier(aggTable)})`).toArray();
+    if (!columns.some((column) => column.name === "__count__")) {
+      runDrizzle(sql$1, sql`ALTER TABLE ${sql.identifier(aggTable)} ADD COLUMN ${AGG_COUNT} INTEGER NOT NULL DEFAULT 0`);
+    }
+  }
+};
+const migrateRankIndexes = (sql$1, tableName, definition) => {
+  if (!definition.rankIndexes) {
+    return;
+  }
+  for (const index of definition.rankIndexes) {
+    const rankTable = rankTableName(tableName, index.name);
+    const sortColumns = index.sortBy.map((_, i) => sortColumnName(i));
+    const columnDdls = sortColumns.map((column) => sql`${sql.identifier(column)} BLOB`);
+    const columnPart = columnDdls.length > 0 ? sql`, ${sql.join(columnDdls, sql`, `)}` : sql``;
+    runDrizzle(
+      sql$1,
+      sql`CREATE TABLE IF NOT EXISTS ${sql.identifier(rankTable)} (${sql.identifier("__id__")} TEXT PRIMARY KEY, ${sql.identifier("__partition__")} TEXT NOT NULL${columnPart})`
+    );
+    const orderedColumns = [sql`${sql.identifier("__partition__")} ASC`];
+    for (const [i, column] of sortColumns.entries()) {
+      const direction = index.sortBy[i]?.direction;
+      orderedColumns.push(sql`${sql.identifier(column)} ${sql.raw(direction === "desc" ? "DESC" : "ASC")}`);
+    }
+    orderedColumns.push(sql`${sql.identifier("__id__")} ASC`);
+    const btreeName = `${tableName}__rank_${index.name}__btree`;
+    runDrizzle(sql$1, createIndexSql(btreeName, rankTable, sql.join(orderedColumns, sql`, `), false));
+  }
+};
+const runShardMigrations = (sql$1, schema, options = {}) => {
+  for (const [tableName, definition] of Object.entries(schema.tables)) {
+    if (definition.shardMode?.kind === "global") {
+      continue;
+    }
+    runDrizzle(
+      sql$1,
+      sql`CREATE TABLE IF NOT EXISTS ${sql.identifier(tableName)} (
+                id TEXT PRIMARY KEY,
+                _creationTime REAL NOT NULL,
+                ${sql.identifier(DOC_COLUMN)} TEXT NOT NULL
+            )`
+    );
+    migrateSecondaryIndexes(sql$1, tableName, definition);
+    migrateSearchIndexes(sql$1, tableName, definition);
+    migrateAggregateIndexes(sql$1, tableName, definition);
+    migrateRankIndexes(sql$1, tableName, definition);
+  }
+  if (options.cdc) {
+    migrateCdcLog(sql$1);
+    migrateCdcMeta(sql$1);
+  }
+  migrateIdempotency(sql$1);
+};
+
+export { runShardMigrations };

package/dist/packem_shared/runTriggers-5N6_Fx0A.mjs

@@ -0,0 +1,20 @@
+const runTriggers = async (options) => {
+  const definitions = options.schema.tables[options.tableName]?.triggerMap;
+  if (!definitions) {
+    return;
+  }
+  for (const definition of Object.values(definitions)) {
+    if (definition.timing === options.timing && definition.op === options.op) {
+      await definition.handler(options.ctx, options.event);
+    }
+  }
+};
+const hasTrigger = (schema, tableName, op) => {
+  const definitions = schema.tables[tableName]?.triggerMap;
+  if (!definitions) {
+    return false;
+  }
+  return Object.values(definitions).some((definition) => definition.op === op);
+};
+
+export { hasTrigger, runTriggers };

package/dist/packem_shared/security-audit-CucgBice.mjs

@@ -0,0 +1,158 @@
+const SECRET_NAME_PATTERN = /key|secret|token|password|passwd|credential|private|auth|bearer|session|cookie|salt|signature|dsn|webhook/iu;
+const LUNORA_INTERNAL_VARS = /* @__PURE__ */ new Set(["LUNORA_ADMIN_TOKEN", "LUNORA_WS_BEARER"]);
+const WORKER_URL_VARS = ["CF_PAGES_URL", "WORKER_URL", "LUNORA_WORKER_URL"];
+const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "WORKER_ENV", "NODE_ENV"];
+const redact = (value) => {
+  if (value.length <= 4) {
+    return "••••";
+  }
+  return `${value.slice(0, 4)}${"•".repeat(Math.min(8, value.length - 4))}`;
+};
+const looksSecret = (name) => SECRET_NAME_PATTERN.test(name);
+const bindingType = (value) => {
+  const has = (key) => typeof value[key] === "function";
+  if (has("idFromName") || has("idFromString")) {
+    return "durable-object";
+  }
+  if (has("createMultipartUpload") || has("put") && has("get") && has("list") && has("head")) {
+    return "r2";
+  }
+  if (has("getWithMetadata")) {
+    return "kv";
+  }
+  if (has("prepare") && has("dump")) {
+    return "d1";
+  }
+  if (has("send") && has("sendBatch")) {
+    return "queue";
+  }
+  if (has("fetch") && !has("get")) {
+    return "service";
+  }
+  return "object";
+};
+const readDeployInfo = (env) => {
+  const deploy = {};
+  for (const key of WORKER_URL_VARS) {
+    if (typeof env[key] === "string" && env[key] !== "") {
+      deploy.workerUrl = env[key];
+      break;
+    }
+  }
+  for (const key of ENVIRONMENT_VARS) {
+    if (typeof env[key] === "string" && env[key] !== "") {
+      deploy.environment = env[key];
+      break;
+    }
+  }
+  const versionMetadata = env["CF_VERSION_METADATA"];
+  if (versionMetadata !== null && typeof versionMetadata === "object") {
+    const meta = versionMetadata;
+    if (typeof meta["id"] === "string") {
+      deploy.deploymentId = meta["id"];
+    }
+    if (typeof meta["tag"] === "string") {
+      deploy.versionTag = meta["tag"];
+    }
+  }
+  return deploy;
+};
+const DEV_ENVIRONMENT_PATTERN = /^(?:dev(?:elopment)?|local(?:host)?|test)$/iu;
+const isDevEnvironment = (rawEnv) => {
+  const env = rawEnv ?? {};
+  for (const key of ENVIRONMENT_VARS) {
+    const value = env[key];
+    if (typeof value === "string" && DEV_ENVIRONMENT_PATTERN.test(value)) {
+      return true;
+    }
+  }
+  return false;
+};
+const buildSettings = (rawEnv) => {
+  const env = rawEnv ?? {};
+  const settings = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (LUNORA_INTERNAL_VARS.has(name)) {
+      continue;
+    }
+    if (typeof value === "string") {
+      const secret = looksSecret(name);
+      settings.push({
+        kind: secret ? "secret" : "var",
+        name,
+        // Both vars and secrets are masked — a "var" may still hold a
+        // sensitive value, and the studio never needs the raw text.
+        value: redact(value)
+      });
+      continue;
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+      settings.push({ kind: "var", name, value: String(value) });
+      continue;
+    }
+    if (value !== null && typeof value === "object") {
+      settings.push({ bindingType: bindingType(value), kind: "binding", name, value: null });
+      continue;
+    }
+    settings.push({ kind: "var", name, value: null });
+  }
+  settings.sort((a, b) => a.name.localeCompare(b.name));
+  return { deploy: readDeployInfo(env), settings };
+};
+
+const MIN_ADMIN_TOKEN_LENGTH = 24;
+const MIN_AUTH_SECRET_LENGTH = 32;
+const LEVEL_ORDER = { error: 0, info: 2, warning: 1 };
+const DISABLED_ENV_VALUES = /* @__PURE__ */ new Set(["0", "disabled", "false", "no", "off"]);
+const ENABLED_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
+const readFlag = (value) => typeof value === "string" ? value.trim().toLowerCase() : void 0;
+const auditAuthSecret = (env) => {
+  const authSecret = env["AUTH_SECRET"] ?? env["BETTER_AUTH_SECRET"];
+  const length = typeof authSecret === "string" ? authSecret.trim().length : 0;
+  if (length > 0 && length < MIN_AUTH_SECRET_LENGTH) {
+    return [{ detail: { length, min: MIN_AUTH_SECRET_LENGTH }, kind: "auth-secret-weak", level: "warning" }];
+  }
+  return [];
+};
+const auditCors = (env) => {
+  const allowedOrigins = readFlag(env["LUNORA_ALLOWED_ORIGINS"]);
+  const corsCredentials = ENABLED_ENV_VALUES.has(readFlag(env["LUNORA_CORS_ALLOW_CREDENTIALS"]) ?? "");
+  const hasWildcard = allowedOrigins?.split(",").some((entry) => entry.trim() === "*") ?? false;
+  return hasWildcard && corsCredentials ? [{ kind: "cors-wildcard-credentials", level: "error" }] : [];
+};
+const auditSecurityLayers = (env, dev) => {
+  if (dev) {
+    return [];
+  }
+  const findings = [];
+  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_HEADERS"]) ?? "")) {
+    findings.push({ kind: "security-headers-disabled", level: "warning" });
+  }
+  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_CSRF"]) ?? "")) {
+    findings.push({ kind: "csrf-disabled", level: "warning" });
+  }
+  if (readFlag(env["BETTER_AUTH_URL"])?.startsWith("http://") === true) {
+    findings.push({ kind: "cookies-insecure", level: "warning" });
+  }
+  return findings;
+};
+const buildSecurityAudit = (rawEnv) => {
+  const env = rawEnv ?? {};
+  const findings = [];
+  const adminToken = env["LUNORA_ADMIN_TOKEN"];
+  if (typeof adminToken === "string" && adminToken.length > 0 && adminToken.length < MIN_ADMIN_TOKEN_LENGTH) {
+    findings.push({ detail: { length: adminToken.length, min: MIN_ADMIN_TOKEN_LENGTH }, kind: "admin-token-weak", level: "warning" });
+  }
+  const wsBearer = env["LUNORA_WS_BEARER"];
+  const dev = isDevEnvironment(env);
+  if (typeof wsBearer !== "string" || wsBearer === "") {
+    findings.push({ kind: "ws-gate-open", level: dev ? "info" : "error" });
+  }
+  if (dev) {
+    findings.push({ kind: "dev-args-unredacted", level: "warning" });
+  }
+  findings.push(...auditAuthSecret(env), ...auditCors(env), ...auditSecurityLayers(env, dev));
+  return { findings: findings.toSorted((a, b) => LEVEL_ORDER[a.level] - LEVEL_ORDER[b.level]) };
+};
+
+export { MIN_ADMIN_TOKEN_LENGTH as M, MIN_AUTH_SECRET_LENGTH as a, buildSecurityAudit as b, buildSettings as c, isDevEnvironment as i };

package/dist/packem_shared/serveRelationFanout-Clr1a05L.mjs

@@ -0,0 +1,24 @@
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTION_PREFIX-Dzdqq5J2.mjs';
+
+const serveRelationFanout = async (schema, database, functionPath, args) => {
+  const table = typeof args["table"] === "string" ? args["table"] : "";
+  const definition = schema.tables[table];
+  if (!definition) {
+    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} unknown table "${table}"`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
+  }
+  if (definition.shardMode?.kind === "global") {
+    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} table "${table}" is global, not shard-local`), {
+      code: "BAD_REQUEST",
+      name: "LunoraError",
+      status: 400
+    });
+  }
+  const where = args["where"] ?? void 0;
+  if (functionPath === `${RELATION_FUNCTION_PREFIX}count`) {
+    return database.count(table, where);
+  }
+  const result = await database.findMany(table, { orderBy: args["orderBy"], where, with: args["with"] });
+  return result.page;
+};
+
+export { serveRelationFanout };

package/package.json

@@ -1,31 +1,55 @@
 {
   "name": "@lunora/do",
-  "version": "0.0.0",
+  "version": "1.0.0-alpha.1",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
-  "license": "FSL-1.1-Apache-2.0",
+  "keywords": [
+    "cloudflare",
+    "durable-objects",
+    "hibernation",
+    "lunora",
+    "shard",
+    "sqlite",
+    "websocket",
+    "workers"
+  ],
   "homepage": "https://lunora.sh",
+  "bugs": "https://github.com/anolilab/lunora/issues",
+  "license": "FSL-1.1-Apache-2.0",
+  "author": {
+    "name": "Daniel Bannert",
+    "email": "d.bannert@anolilab.de"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/anolilab/lunora.git",
     "directory": "packages/do"
   },
-  "bugs": {
-    "url": "https://github.com/anolilab/lunora/issues"
-  },
-  "keywords": [
-    "lunora",
-    "cloudflare",
-    "workers",
-    "durable-objects",
-    "sqlite",
-    "websocket",
-    "hibernation",
-    "shard"
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE.md",
+    "__assets__"
   ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "README.md"
-  ]
+  "dependencies": {
+    "@visulima/redact": "3.0.0-alpha.14",
+    "drizzle-orm": "^0.45.2"
+  },
+  "engines": {
+    "node": "^22.15.0 || >=24.11.0"
+  }
 }