@lunora/do 0.0.0 → 1.0.0-alpha.10

package/dist/packem_shared/security-audit-CucgBice.mjs

@@ -0,0 +1,158 @@
+const SECRET_NAME_PATTERN = /key|secret|token|password|passwd|credential|private|auth|bearer|session|cookie|salt|signature|dsn|webhook/iu;
+const LUNORA_INTERNAL_VARS = /* @__PURE__ */ new Set(["LUNORA_ADMIN_TOKEN", "LUNORA_WS_BEARER"]);
+const WORKER_URL_VARS = ["CF_PAGES_URL", "WORKER_URL", "LUNORA_WORKER_URL"];
+const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "WORKER_ENV", "NODE_ENV"];
+const redact = (value) => {
+  if (value.length <= 4) {
+    return "••••";
+  }
+  return `${value.slice(0, 4)}${"•".repeat(Math.min(8, value.length - 4))}`;
+};
+const looksSecret = (name) => SECRET_NAME_PATTERN.test(name);
+const bindingType = (value) => {
+  const has = (key) => typeof value[key] === "function";
+  if (has("idFromName") || has("idFromString")) {
+    return "durable-object";
+  }
+  if (has("createMultipartUpload") || has("put") && has("get") && has("list") && has("head")) {
+    return "r2";
+  }
+  if (has("getWithMetadata")) {
+    return "kv";
+  }
+  if (has("prepare") && has("dump")) {
+    return "d1";
+  }
+  if (has("send") && has("sendBatch")) {
+    return "queue";
+  }
+  if (has("fetch") && !has("get")) {
+    return "service";
+  }
+  return "object";
+};
+const readDeployInfo = (env) => {
+  const deploy = {};
+  for (const key of WORKER_URL_VARS) {
+    if (typeof env[key] === "string" && env[key] !== "") {
+      deploy.workerUrl = env[key];
+      break;
+    }
+  }
+  for (const key of ENVIRONMENT_VARS) {
+    if (typeof env[key] === "string" && env[key] !== "") {
+      deploy.environment = env[key];
+      break;
+    }
+  }
+  const versionMetadata = env["CF_VERSION_METADATA"];
+  if (versionMetadata !== null && typeof versionMetadata === "object") {
+    const meta = versionMetadata;
+    if (typeof meta["id"] === "string") {
+      deploy.deploymentId = meta["id"];
+    }
+    if (typeof meta["tag"] === "string") {
+      deploy.versionTag = meta["tag"];
+    }
+  }
+  return deploy;
+};
+const DEV_ENVIRONMENT_PATTERN = /^(?:dev(?:elopment)?|local(?:host)?|test)$/iu;
+const isDevEnvironment = (rawEnv) => {
+  const env = rawEnv ?? {};
+  for (const key of ENVIRONMENT_VARS) {
+    const value = env[key];
+    if (typeof value === "string" && DEV_ENVIRONMENT_PATTERN.test(value)) {
+      return true;
+    }
+  }
+  return false;
+};
+const buildSettings = (rawEnv) => {
+  const env = rawEnv ?? {};
+  const settings = [];
+  for (const [name, value] of Object.entries(env)) {
+    if (LUNORA_INTERNAL_VARS.has(name)) {
+      continue;
+    }
+    if (typeof value === "string") {
+      const secret = looksSecret(name);
+      settings.push({
+        kind: secret ? "secret" : "var",
+        name,
+        // Both vars and secrets are masked — a "var" may still hold a
+        // sensitive value, and the studio never needs the raw text.
+        value: redact(value)
+      });
+      continue;
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+      settings.push({ kind: "var", name, value: String(value) });
+      continue;
+    }
+    if (value !== null && typeof value === "object") {
+      settings.push({ bindingType: bindingType(value), kind: "binding", name, value: null });
+      continue;
+    }
+    settings.push({ kind: "var", name, value: null });
+  }
+  settings.sort((a, b) => a.name.localeCompare(b.name));
+  return { deploy: readDeployInfo(env), settings };
+};
+
+const MIN_ADMIN_TOKEN_LENGTH = 24;
+const MIN_AUTH_SECRET_LENGTH = 32;
+const LEVEL_ORDER = { error: 0, info: 2, warning: 1 };
+const DISABLED_ENV_VALUES = /* @__PURE__ */ new Set(["0", "disabled", "false", "no", "off"]);
+const ENABLED_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
+const readFlag = (value) => typeof value === "string" ? value.trim().toLowerCase() : void 0;
+const auditAuthSecret = (env) => {
+  const authSecret = env["AUTH_SECRET"] ?? env["BETTER_AUTH_SECRET"];
+  const length = typeof authSecret === "string" ? authSecret.trim().length : 0;
+  if (length > 0 && length < MIN_AUTH_SECRET_LENGTH) {
+    return [{ detail: { length, min: MIN_AUTH_SECRET_LENGTH }, kind: "auth-secret-weak", level: "warning" }];
+  }
+  return [];
+};
+const auditCors = (env) => {
+  const allowedOrigins = readFlag(env["LUNORA_ALLOWED_ORIGINS"]);
+  const corsCredentials = ENABLED_ENV_VALUES.has(readFlag(env["LUNORA_CORS_ALLOW_CREDENTIALS"]) ?? "");
+  const hasWildcard = allowedOrigins?.split(",").some((entry) => entry.trim() === "*") ?? false;
+  return hasWildcard && corsCredentials ? [{ kind: "cors-wildcard-credentials", level: "error" }] : [];
+};
+const auditSecurityLayers = (env, dev) => {
+  if (dev) {
+    return [];
+  }
+  const findings = [];
+  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_HEADERS"]) ?? "")) {
+    findings.push({ kind: "security-headers-disabled", level: "warning" });
+  }
+  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_CSRF"]) ?? "")) {
+    findings.push({ kind: "csrf-disabled", level: "warning" });
+  }
+  if (readFlag(env["BETTER_AUTH_URL"])?.startsWith("http://") === true) {
+    findings.push({ kind: "cookies-insecure", level: "warning" });
+  }
+  return findings;
+};
+const buildSecurityAudit = (rawEnv) => {
+  const env = rawEnv ?? {};
+  const findings = [];
+  const adminToken = env["LUNORA_ADMIN_TOKEN"];
+  if (typeof adminToken === "string" && adminToken.length > 0 && adminToken.length < MIN_ADMIN_TOKEN_LENGTH) {
+    findings.push({ detail: { length: adminToken.length, min: MIN_ADMIN_TOKEN_LENGTH }, kind: "admin-token-weak", level: "warning" });
+  }
+  const wsBearer = env["LUNORA_WS_BEARER"];
+  const dev = isDevEnvironment(env);
+  if (typeof wsBearer !== "string" || wsBearer === "") {
+    findings.push({ kind: "ws-gate-open", level: dev ? "info" : "error" });
+  }
+  if (dev) {
+    findings.push({ kind: "dev-args-unredacted", level: "warning" });
+  }
+  findings.push(...auditAuthSecret(env), ...auditCors(env), ...auditSecurityLayers(env, dev));
+  return { findings: findings.toSorted((a, b) => LEVEL_ORDER[a.level] - LEVEL_ORDER[b.level]) };
+};
+
+export { MIN_ADMIN_TOKEN_LENGTH as M, MIN_AUTH_SECRET_LENGTH as a, buildSecurityAudit as b, buildSettings as c, isDevEnvironment as i };

package/dist/packem_shared/serialize-sql-BlRUoiQe.mjs

@@ -0,0 +1,14 @@
+const serializeSqlValue = (value) => {
+  if (typeof value === "boolean") {
+    return value ? 1 : 0;
+  }
+  if (value === null || typeof value === "string" || typeof value === "number") {
+    return value;
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return JSON.stringify(value);
+};
+
+export { serializeSqlValue as s };

package/dist/packem_shared/serveRelationFanout-C6lDaesn.mjs

@@ -0,0 +1,24 @@
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-D_UiYJFk.mjs';
+
+const serveRelationFanout = async (schema, database, functionPath, args) => {
+  const table = typeof args["table"] === "string" ? args["table"] : "";
+  const definition = schema.tables[table];
+  if (!definition) {
+    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} unknown table "${table}"`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
+  }
+  if (definition.shardMode?.kind === "global") {
+    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} table "${table}" is global, not shard-local`), {
+      code: "BAD_REQUEST",
+      name: "LunoraError",
+      status: 400
+    });
+  }
+  const where = args["where"] ?? void 0;
+  if (functionPath === `${RELATION_FUNCTION_PREFIX}count`) {
+    return database.count(table, where);
+  }
+  const result = await database.findMany(table, { orderBy: args["orderBy"], where, with: args["with"] });
+  return result.page;
+};
+
+export { serveRelationFanout };

package/dist/packem_shared/stableStringify-CyHKJXre.mjs

@@ -0,0 +1,30 @@
+const compareKeys = (a, b) => {
+  if (a < b) {
+    return -1;
+  }
+  return a > b ? 1 : 0;
+};
+const stableStringify = (value) => {
+  if (value === void 0) {
+    return "null";
+  }
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const record = value;
+  const keys = Object.keys(record).toSorted(compareKeys);
+  const parts = [];
+  for (const key of keys) {
+    const raw = record[key];
+    if (raw === void 0) {
+      continue;
+    }
+    parts.push(`${JSON.stringify(key)}:${stableStringify(raw)}`);
+  }
+  return `{${parts.join(",")}}`;
+};
+
+export { stableStringify };

package/dist/packem_shared/subscriptionListDeltas-ce84gpwL.mjs

@@ -0,0 +1,111 @@
+const ROW_ID_FIELD = "_id";
+const DELTA_FALLBACK_TABLE = "__lunora__";
+const readRowId = (row) => {
+  if (typeof row !== "object" || row === null || Array.isArray(row)) {
+    return void 0;
+  }
+  const id = row[ROW_ID_FIELD];
+  return typeof id === "string" ? id : void 0;
+};
+const indexRowsById = (rows) => {
+  const byId = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const row of rows) {
+    const id = readRowId(row);
+    if (id === void 0 || byId.has(id)) {
+      return void 0;
+    }
+    byId.set(id, row);
+    order.push(id);
+  }
+  return { byId, order };
+};
+const survivorsKeepOrder = (previous, next) => {
+  const survivingPrevious = previous.order.filter((id) => next.byId.has(id));
+  const survivingNext = next.order.filter((id) => previous.byId.has(id));
+  if (survivingPrevious.length !== survivingNext.length) {
+    return false;
+  }
+  return survivingPrevious.every((id, index) => survivingNext[index] === id);
+};
+const collectDeleteDeltas = (previous, next, deltaTable, tableJson) => {
+  const out = [];
+  for (const id of previous.order) {
+    if (!next.byId.has(id)) {
+      out.push({
+        delta: { key: id, op: "delete", table: deltaTable },
+        frame: `{"key":${JSON.stringify(id)},"op":"delete","table":${tableJson}}`
+      });
+    }
+  }
+  return out;
+};
+const collectUpsertDeltas = (previous, next, deltaTable, tableJson) => {
+  const out = [];
+  for (const id of next.order) {
+    const nextRow = next.byId.get(id);
+    const previousRow = previous.byId.get(id);
+    const nextFingerprint = JSON.stringify(nextRow);
+    const previousFingerprint = previousRow === void 0 ? void 0 : JSON.stringify(previousRow);
+    if (previousFingerprint === nextFingerprint) {
+      continue;
+    }
+    const op = previousFingerprint === void 0 ? "insert" : "update";
+    out.push({
+      delta: { key: id, op, row: nextRow, table: deltaTable },
+      frame: `{"key":${JSON.stringify(id)},"op":"${op}","row":${nextFingerprint},"table":${tableJson}}`
+    });
+  }
+  return out;
+};
+const subscriptionListDeltas = (previousJson, nextResult, table, frames) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(previousJson);
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(parsed) || !Array.isArray(nextResult)) {
+    return void 0;
+  }
+  const previous = indexRowsById(parsed);
+  const next = indexRowsById(nextResult);
+  if (previous === void 0 || next === void 0) {
+    return void 0;
+  }
+  if (!survivorsKeepOrder(previous, next)) {
+    return void 0;
+  }
+  const deltaTable = table === "" ? DELTA_FALLBACK_TABLE : table;
+  const tableJson = JSON.stringify(deltaTable);
+  const framed = [...collectDeleteDeltas(previous, next, deltaTable, tableJson), ...collectUpsertDeltas(previous, next, deltaTable, tableJson)];
+  if (framed.length > next.order.length) {
+    return void 0;
+  }
+  if (frames !== void 0) {
+    for (const { frame } of framed) {
+      frames.push(frame);
+    }
+  }
+  return framed.map(({ delta }) => delta);
+};
+const trySendFrame = (ws, frame) => {
+  try {
+    ws.send(frame);
+    return true;
+  } catch {
+    return false;
+  }
+};
+const sendDeltaFrames = (ws, subId, deltaFrames, cursorSuffix) => {
+  const idJson = JSON.stringify(subId);
+  let delivered = true;
+  for (const deltaBody of deltaFrames) {
+    if (!trySendFrame(ws, `{"type":"delta","id":${idJson},"delta":${deltaBody}${cursorSuffix}}`)) {
+      delivered = false;
+    }
+  }
+  return delivered;
+};
+
+export { sendDeltaFrames, subscriptionListDeltas, trySendFrame };

package/package.json

@@ -1,31 +1,55 @@
 {
   "name": "@lunora/do",
-  "version": "0.0.0",
+  "version": "1.0.0-alpha.10",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
-  "license": "FSL-1.1-Apache-2.0",
+  "keywords": [
+    "cloudflare",
+    "durable-objects",
+    "hibernation",
+    "lunora",
+    "shard",
+    "sqlite",
+    "websocket",
+    "workers"
+  ],
   "homepage": "https://lunora.sh",
+  "bugs": "https://github.com/anolilab/lunora/issues",
+  "license": "FSL-1.1-Apache-2.0",
+  "author": {
+    "name": "Daniel Bannert",
+    "email": "d.bannert@anolilab.de"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/anolilab/lunora.git",
     "directory": "packages/do"
   },
-  "bugs": {
-    "url": "https://github.com/anolilab/lunora/issues"
-  },
-  "keywords": [
-    "lunora",
-    "cloudflare",
-    "workers",
-    "durable-objects",
-    "sqlite",
-    "websocket",
-    "hibernation",
-    "shard"
+  "files": [
+    "./dist",
+    "README.md",
+    "LICENSE.md",
+    "__assets__"
   ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "README.md"
-  ]
+  "dependencies": {
+    "@visulima/redact": "3.0.0-alpha.14",
+    "drizzle-orm": "^0.45.2"
+  },
+  "engines": {
+    "node": "^22.15.0 || >=24.11.0"
+  }
 }