@lunora/do 1.0.0-alpha.15 → 1.0.0-alpha.151

package/dist/packem_shared/security-audit-CucgBice.mjs

@@ -1,158 +0,0 @@
-const SECRET_NAME_PATTERN = /key|secret|token|password|passwd|credential|private|auth|bearer|session|cookie|salt|signature|dsn|webhook/iu;
-const LUNORA_INTERNAL_VARS = /* @__PURE__ */ new Set(["LUNORA_ADMIN_TOKEN", "LUNORA_WS_BEARER"]);
-const WORKER_URL_VARS = ["CF_PAGES_URL", "WORKER_URL", "LUNORA_WORKER_URL"];
-const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "WORKER_ENV", "NODE_ENV"];
-const redact = (value) => {
-  if (value.length <= 4) {
-    return "••••";
-  }
-  return `${value.slice(0, 4)}${"•".repeat(Math.min(8, value.length - 4))}`;
-};
-const looksSecret = (name) => SECRET_NAME_PATTERN.test(name);
-const bindingType = (value) => {
-  const has = (key) => typeof value[key] === "function";
-  if (has("idFromName") || has("idFromString")) {
-    return "durable-object";
-  }
-  if (has("createMultipartUpload") || has("put") && has("get") && has("list") && has("head")) {
-    return "r2";
-  }
-  if (has("getWithMetadata")) {
-    return "kv";
-  }
-  if (has("prepare") && has("dump")) {
-    return "d1";
-  }
-  if (has("send") && has("sendBatch")) {
-    return "queue";
-  }
-  if (has("fetch") && !has("get")) {
-    return "service";
-  }
-  return "object";
-};
-const readDeployInfo = (env) => {
-  const deploy = {};
-  for (const key of WORKER_URL_VARS) {
-    if (typeof env[key] === "string" && env[key] !== "") {
-      deploy.workerUrl = env[key];
-      break;
-    }
-  }
-  for (const key of ENVIRONMENT_VARS) {
-    if (typeof env[key] === "string" && env[key] !== "") {
-      deploy.environment = env[key];
-      break;
-    }
-  }
-  const versionMetadata = env["CF_VERSION_METADATA"];
-  if (versionMetadata !== null && typeof versionMetadata === "object") {
-    const meta = versionMetadata;
-    if (typeof meta["id"] === "string") {
-      deploy.deploymentId = meta["id"];
-    }
-    if (typeof meta["tag"] === "string") {
-      deploy.versionTag = meta["tag"];
-    }
-  }
-  return deploy;
-};
-const DEV_ENVIRONMENT_PATTERN = /^(?:dev(?:elopment)?|local(?:host)?|test)$/iu;
-const isDevEnvironment = (rawEnv) => {
-  const env = rawEnv ?? {};
-  for (const key of ENVIRONMENT_VARS) {
-    const value = env[key];
-    if (typeof value === "string" && DEV_ENVIRONMENT_PATTERN.test(value)) {
-      return true;
-    }
-  }
-  return false;
-};
-const buildSettings = (rawEnv) => {
-  const env = rawEnv ?? {};
-  const settings = [];
-  for (const [name, value] of Object.entries(env)) {
-    if (LUNORA_INTERNAL_VARS.has(name)) {
-      continue;
-    }
-    if (typeof value === "string") {
-      const secret = looksSecret(name);
-      settings.push({
-        kind: secret ? "secret" : "var",
-        name,
-        // Both vars and secrets are masked — a "var" may still hold a
-        // sensitive value, and the studio never needs the raw text.
-        value: redact(value)
-      });
-      continue;
-    }
-    if (typeof value === "number" || typeof value === "boolean") {
-      settings.push({ kind: "var", name, value: String(value) });
-      continue;
-    }
-    if (value !== null && typeof value === "object") {
-      settings.push({ bindingType: bindingType(value), kind: "binding", name, value: null });
-      continue;
-    }
-    settings.push({ kind: "var", name, value: null });
-  }
-  settings.sort((a, b) => a.name.localeCompare(b.name));
-  return { deploy: readDeployInfo(env), settings };
-};
-
-const MIN_ADMIN_TOKEN_LENGTH = 24;
-const MIN_AUTH_SECRET_LENGTH = 32;
-const LEVEL_ORDER = { error: 0, info: 2, warning: 1 };
-const DISABLED_ENV_VALUES = /* @__PURE__ */ new Set(["0", "disabled", "false", "no", "off"]);
-const ENABLED_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
-const readFlag = (value) => typeof value === "string" ? value.trim().toLowerCase() : void 0;
-const auditAuthSecret = (env) => {
-  const authSecret = env["AUTH_SECRET"] ?? env["BETTER_AUTH_SECRET"];
-  const length = typeof authSecret === "string" ? authSecret.trim().length : 0;
-  if (length > 0 && length < MIN_AUTH_SECRET_LENGTH) {
-    return [{ detail: { length, min: MIN_AUTH_SECRET_LENGTH }, kind: "auth-secret-weak", level: "warning" }];
-  }
-  return [];
-};
-const auditCors = (env) => {
-  const allowedOrigins = readFlag(env["LUNORA_ALLOWED_ORIGINS"]);
-  const corsCredentials = ENABLED_ENV_VALUES.has(readFlag(env["LUNORA_CORS_ALLOW_CREDENTIALS"]) ?? "");
-  const hasWildcard = allowedOrigins?.split(",").some((entry) => entry.trim() === "*") ?? false;
-  return hasWildcard && corsCredentials ? [{ kind: "cors-wildcard-credentials", level: "error" }] : [];
-};
-const auditSecurityLayers = (env, dev) => {
-  if (dev) {
-    return [];
-  }
-  const findings = [];
-  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_HEADERS"]) ?? "")) {
-    findings.push({ kind: "security-headers-disabled", level: "warning" });
-  }
-  if (DISABLED_ENV_VALUES.has(readFlag(env["LUNORA_SECURITY_CSRF"]) ?? "")) {
-    findings.push({ kind: "csrf-disabled", level: "warning" });
-  }
-  if (readFlag(env["BETTER_AUTH_URL"])?.startsWith("http://") === true) {
-    findings.push({ kind: "cookies-insecure", level: "warning" });
-  }
-  return findings;
-};
-const buildSecurityAudit = (rawEnv) => {
-  const env = rawEnv ?? {};
-  const findings = [];
-  const adminToken = env["LUNORA_ADMIN_TOKEN"];
-  if (typeof adminToken === "string" && adminToken.length > 0 && adminToken.length < MIN_ADMIN_TOKEN_LENGTH) {
-    findings.push({ detail: { length: adminToken.length, min: MIN_ADMIN_TOKEN_LENGTH }, kind: "admin-token-weak", level: "warning" });
-  }
-  const wsBearer = env["LUNORA_WS_BEARER"];
-  const dev = isDevEnvironment(env);
-  if (typeof wsBearer !== "string" || wsBearer === "") {
-    findings.push({ kind: "ws-gate-open", level: dev ? "info" : "error" });
-  }
-  if (dev) {
-    findings.push({ kind: "dev-args-unredacted", level: "warning" });
-  }
-  findings.push(...auditAuthSecret(env), ...auditCors(env), ...auditSecurityLayers(env, dev));
-  return { findings: findings.toSorted((a, b) => LEVEL_ORDER[a.level] - LEVEL_ORDER[b.level]) };
-};
-
-export { MIN_ADMIN_TOKEN_LENGTH as M, MIN_AUTH_SECRET_LENGTH as a, buildSecurityAudit as b, buildSettings as c, isDevEnvironment as i };

package/dist/packem_shared/serialize-sql-BlRUoiQe.mjs

@@ -1,14 +0,0 @@
-const serializeSqlValue = (value) => {
-  if (typeof value === "boolean") {
-    return value ? 1 : 0;
-  }
-  if (value === null || typeof value === "string" || typeof value === "number") {
-    return value;
-  }
-  if (typeof value === "bigint") {
-    return value.toString();
-  }
-  return JSON.stringify(value);
-};
-
-export { serializeSqlValue as s };

package/dist/packem_shared/serveRelationFanout-EZLD9-O3.mjs

@@ -1,24 +0,0 @@
-import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-fMl1vyt1.mjs';
-
-const serveRelationFanout = async (schema, database, functionPath, args) => {
-  const table = typeof args["table"] === "string" ? args["table"] : "";
-  const definition = schema.tables[table];
-  if (!definition) {
-    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} unknown table "${table}"`), { code: "UNKNOWN_TABLE", name: "LunoraError", status: 404 });
-  }
-  if (definition.shardMode?.kind === "global") {
-    throw Object.assign(new Error(`${RELATION_FUNCTION_PREFIX} table "${table}" is global, not shard-local`), {
-      code: "BAD_REQUEST",
-      name: "LunoraError",
-      status: 400
-    });
-  }
-  const where = args["where"] ?? void 0;
-  if (functionPath === `${RELATION_FUNCTION_PREFIX}count`) {
-    return database.count(table, where);
-  }
-  const result = await database.findMany(table, { orderBy: args["orderBy"], where, with: args["with"] });
-  return result.page;
-};
-
-export { serveRelationFanout };

package/dist/packem_shared/stableStringify-MydiuScU.mjs

@@ -1,40 +0,0 @@
-const compareKeys = (a, b) => {
-  if (a < b) {
-    return -1;
-  }
-  return a > b ? 1 : 0;
-};
-const stableStringify = (value) => {
-  if (value === void 0) {
-    return "null";
-  }
-  if (typeof value === "bigint") {
-    throw new TypeError("stableStringify: cannot use a bigint in a cache key (query/subscription/shape args) — pass it as a string");
-  }
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-  }
-  const proto = Object.getPrototypeOf(value);
-  if (proto !== null && proto !== Object.prototype) {
-    const name = value.constructor?.name ?? "value";
-    throw new TypeError(
-      `stableStringify: cannot use a ${name} in a cache key (query/subscription/shape args) — only plain objects, arrays, and JSON primitives are supported`
-    );
-  }
-  const record = value;
-  const keys = Object.keys(record).toSorted(compareKeys);
-  const parts = [];
-  for (const key of keys) {
-    const raw = record[key];
-    if (raw === void 0) {
-      continue;
-    }
-    parts.push(`${JSON.stringify(key)}:${stableStringify(raw)}`);
-  }
-  return `{${parts.join(",")}}`;
-};
-
-export { stableStringify };

package/dist/packem_shared/subscription-delivery-Z6nXHvQN.mjs

@@ -1,340 +0,0 @@
-const TAG = "$lunora.wire$";
-const MAX_DEPTH = 64;
-const MAX_BIGINT_DIGITS = 1024;
-const UNSAFE_KEY = "__proto__";
-const TYPED_ARRAY_CTORS = {
-  BigInt64Array,
-  BigUint64Array,
-  Float32Array,
-  Float64Array,
-  Int8Array,
-  Int16Array,
-  Int32Array,
-  Uint8Array,
-  Uint8ClampedArray,
-  Uint16Array,
-  Uint32Array
-};
-const ERROR_CTORS = {
-  Error,
-  EvalError,
-  RangeError,
-  ReferenceError,
-  SyntaxError,
-  TypeError,
-  URIError
-};
-const toBase64 = (bytes) => {
-  let binary = "";
-  const chunk = 32768;
-  for (let index = 0; index < bytes.length; index += chunk) {
-    binary += String.fromCharCode(...bytes.subarray(index, index + chunk));
-  }
-  return btoa(binary);
-};
-const fromBase64 = (base64) => {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let index = 0; index < binary.length; index += 1) {
-    bytes[index] = binary.codePointAt(index) ?? 0;
-  }
-  return bytes;
-};
-const encodeWire = (value, depth = 0) => {
-  if (depth > MAX_DEPTH) {
-    throw new RangeError(`wire-codec: value nesting exceeds the ${MAX_DEPTH}-level limit`);
-  }
-  if (value === void 0) {
-    return [TAG, "undefined"];
-  }
-  if (value === null) {
-    return null;
-  }
-  const kind = typeof value;
-  if (kind === "bigint") {
-    return [TAG, "bigint", value.toString()];
-  }
-  if (kind === "number") {
-    const numeric = value;
-    if (Number.isNaN(numeric)) {
-      return [TAG, "nan"];
-    }
-    if (numeric === Infinity) {
-      return [TAG, "inf"];
-    }
-    if (numeric === -Infinity) {
-      return [TAG, "-inf"];
-    }
-    return numeric;
-  }
-  if (kind !== "object") {
-    return value;
-  }
-  if (value instanceof Date) {
-    return [TAG, "date", encodeWire(value.getTime(), depth + 1)];
-  }
-  if (value instanceof Error) {
-    const error = value;
-    const properties = {};
-    for (const key of Object.keys(error)) {
-      if (error[key] !== void 0) {
-        properties[key] = encodeWire(error[key], depth + 1);
-      }
-    }
-    const encodedError = [TAG, "error", error.name, error.message, properties];
-    if (error.cause !== void 0) {
-      encodedError.push(encodeWire(error.cause, depth + 1));
-    }
-    return encodedError;
-  }
-  if (value instanceof URL) {
-    return [TAG, "url", value.href];
-  }
-  if (value instanceof Map) {
-    return [TAG, "map", [...value.entries()].map(([k, v]) => [encodeWire(k, depth + 1), encodeWire(v, depth + 1)])];
-  }
-  if (value instanceof Set) {
-    return [TAG, "set", [...value].map((item) => encodeWire(item, depth + 1))];
-  }
-  if (value instanceof ArrayBuffer) {
-    return [TAG, "bytes", toBase64(new Uint8Array(value)), "ArrayBuffer"];
-  }
-  if (ArrayBuffer.isView(value)) {
-    const view = value;
-    const ctorName = view.constructor.name;
-    const bytes = new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
-    return ctorName === "Uint8Array" ? [TAG, "bytes", toBase64(bytes)] : [TAG, "bytes", toBase64(bytes), ctorName];
-  }
-  if (Array.isArray(value)) {
-    const encoded = value.map((item) => encodeWire(item, depth + 1));
-    return encoded.length > 0 && encoded[0] === TAG ? [TAG, "arr", encoded] : encoded;
-  }
-  const proto = Object.getPrototypeOf(value);
-  if (proto !== null && proto !== Object.prototype) {
-    const name = value.constructor?.name ?? "value";
-    throw new TypeError(
-      `wire-codec: cannot encode a ${name} over the Lunora wire — only plain objects, arrays, and the supported built-ins (Date, Error, URL, Map, Set, ArrayBuffer/typed arrays, bigint) round-trip`
-    );
-  }
-  const source = value;
-  const result = {};
-  for (const key of Object.keys(source)) {
-    const field = source[key];
-    if (field !== void 0) {
-      result[key] = encodeWire(field, depth + 1);
-    }
-  }
-  return result;
-};
-const decodeWire = (value, depth = 0) => {
-  if (depth > MAX_DEPTH) {
-    throw new RangeError(`wire-codec: value nesting exceeds the ${MAX_DEPTH}-level limit`);
-  }
-  if (value === null || typeof value !== "object") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    if (value[0] === TAG) {
-      const tag = value[1];
-      switch (tag) {
-        case "-inf": {
-          return -Infinity;
-        }
-        case "arr": {
-          return value[2].map((item) => decodeWire(item, depth + 1));
-        }
-        case "bigint": {
-          const raw = value[2];
-          if (typeof raw !== "string" || raw.length > MAX_BIGINT_DIGITS || !/^-?\d+$/.test(raw)) {
-            throw new RangeError(`wire-codec: invalid or over-long bigint (max ${MAX_BIGINT_DIGITS} digits)`);
-          }
-          return BigInt(raw);
-        }
-        case "date": {
-          return new Date(decodeWire(value[2], depth + 1));
-        }
-        case "map": {
-          return new Map(value[2].map(([k, v]) => [decodeWire(k, depth + 1), decodeWire(v, depth + 1)]));
-        }
-        case "set": {
-          return new Set(value[2].map((item) => decodeWire(item, depth + 1)));
-        }
-        case "url": {
-          return new URL(value[2]);
-        }
-        case "error": {
-          const name = value[2];
-          const message = value[3];
-          const Ctor = (Object.hasOwn(ERROR_CTORS, name) ? ERROR_CTORS[name] : void 0) ?? Error;
-          const error = new Ctor(message);
-          if (error.name !== name) {
-            Object.defineProperty(error, "name", { configurable: true, value: name, writable: true });
-          }
-          Object.assign(error, decodeWire(value[4], depth + 1));
-          if (value.length > 5) {
-            Object.defineProperty(error, "cause", { configurable: true, value: decodeWire(value[5], depth + 1), writable: true });
-          }
-          return error;
-        }
-        case "bytes": {
-          const bytes = fromBase64(value[2]);
-          const ctorName = value[3] ?? "Uint8Array";
-          if (ctorName === "ArrayBuffer") {
-            return bytes.buffer.byteLength === bytes.byteLength ? bytes.buffer : bytes.slice().buffer;
-          }
-          const Ctor = Object.hasOwn(TYPED_ARRAY_CTORS, ctorName) ? TYPED_ARRAY_CTORS[ctorName] : void 0;
-          return Ctor ? new Ctor(bytes.slice().buffer) : bytes;
-        }
-        case "inf": {
-          return Infinity;
-        }
-        case "nan": {
-          return Number.NaN;
-        }
-        case "undefined": {
-          return void 0;
-        }
-        default: {
-          return value.map((item) => decodeWire(item, depth + 1));
-        }
-      }
-    }
-    return value.map((item) => decodeWire(item, depth + 1));
-  }
-  const source = value;
-  const result = {};
-  for (const key of Object.keys(source)) {
-    const decoded = decodeWire(source[key], depth + 1);
-    if (key === UNSAFE_KEY) {
-      Object.defineProperty(result, key, { configurable: true, enumerable: true, value: decoded, writable: true });
-    } else {
-      result[key] = decoded;
-    }
-  }
-  return result;
-};
-
-const ROW_ID_FIELD = "_id";
-const DELTA_FALLBACK_TABLE = "__lunora__";
-const readRowId = (row) => {
-  if (typeof row !== "object" || row === null || Array.isArray(row)) {
-    return void 0;
-  }
-  const id = row[ROW_ID_FIELD];
-  return typeof id === "string" ? id : void 0;
-};
-const indexRowsById = (rows) => {
-  const byId = /* @__PURE__ */ new Map();
-  const order = [];
-  for (const row of rows) {
-    const id = readRowId(row);
-    if (id === void 0 || byId.has(id)) {
-      return void 0;
-    }
-    byId.set(id, row);
-    order.push(id);
-  }
-  return { byId, order };
-};
-const survivorsKeepOrder = (previous, next) => {
-  const survivingPrevious = previous.order.filter((id) => next.byId.has(id));
-  const survivingNext = next.order.filter((id) => previous.byId.has(id));
-  if (survivingPrevious.length !== survivingNext.length) {
-    return false;
-  }
-  return survivingPrevious.every((id, index) => survivingNext[index] === id);
-};
-const collectDeleteDeltas = (previous, next, deltaTable, tableJson) => {
-  const out = [];
-  for (const id of previous.order) {
-    if (!next.byId.has(id)) {
-      out.push({
-        delta: { key: id, op: "delete", table: deltaTable },
-        frame: `{"key":${JSON.stringify(id)},"op":"delete","table":${tableJson}}`
-      });
-    }
-  }
-  return out;
-};
-const collectUpsertDeltas = (previous, next, deltaTable, tableJson) => {
-  const out = [];
-  for (const id of next.order) {
-    const nextRow = next.byId.get(id);
-    const previousRow = previous.byId.get(id);
-    const nextFingerprint = JSON.stringify(encodeWire(nextRow));
-    const previousFingerprint = previousRow === void 0 ? void 0 : JSON.stringify(previousRow);
-    if (previousFingerprint === nextFingerprint) {
-      continue;
-    }
-    const op = previousFingerprint === void 0 ? "insert" : "update";
-    out.push({
-      delta: { key: id, op, row: nextRow, table: deltaTable },
-      frame: `{"key":${JSON.stringify(id)},"op":"${op}","row":${nextFingerprint},"table":${tableJson}}`
-    });
-  }
-  return out;
-};
-const subscriptionListDeltas = (previousJson, nextResult, table, frames) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(previousJson);
-  } catch {
-    return void 0;
-  }
-  if (!Array.isArray(parsed) || !Array.isArray(nextResult)) {
-    return void 0;
-  }
-  const previous = indexRowsById(parsed);
-  const next = indexRowsById(nextResult);
-  if (previous === void 0 || next === void 0) {
-    return void 0;
-  }
-  if (!survivorsKeepOrder(previous, next)) {
-    return void 0;
-  }
-  const deltaTable = table === "" ? DELTA_FALLBACK_TABLE : table;
-  const tableJson = JSON.stringify(deltaTable);
-  const framed = [...collectDeleteDeltas(previous, next, deltaTable, tableJson), ...collectUpsertDeltas(previous, next, deltaTable, tableJson)];
-  if (framed.length > next.order.length) {
-    return void 0;
-  }
-  if (frames !== void 0) {
-    for (const { frame } of framed) {
-      frames.push(frame);
-    }
-  }
-  return framed.map(({ delta }) => delta);
-};
-const trySendFrame = (ws, frame) => {
-  try {
-    ws.send(frame);
-    return true;
-  } catch {
-    return false;
-  }
-};
-const sendDeltaFrames = (ws, subId, deltaFrames, cursorSuffix) => {
-  const idJson = JSON.stringify(subId);
-  let delivered = true;
-  for (const deltaBody of deltaFrames) {
-    if (!trySendFrame(ws, `{"type":"delta","id":${idJson},"delta":${deltaBody}${cursorSuffix}}`)) {
-      delivered = false;
-    }
-  }
-  return delivered;
-};
-const awaitWsDrain = async (ws) => {
-  let attempts = 0;
-  while (attempts < 100) {
-    attempts += 1;
-    const buffered = ws.bufferedAmount;
-    if (typeof buffered !== "number" || buffered < 1048576) {
-      return;
-    }
-    await new Promise((resolve) => {
-      setTimeout(resolve, 20);
-    });
-  }
-};
-
-export { awaitWsDrain as a, sendDeltaFrames as b, decodeWire as d, encodeWire as e, subscriptionListDeltas as s, trySendFrame as t };

package/dist/packem_shared/subscriptionListDeltas-CXwfoEE_.mjs

@@ -1 +0,0 @@
-export { a as awaitWsDrain, b as sendDeltaFrames, s as subscriptionListDeltas, t as trySendFrame } from './subscription-delivery-Z6nXHvQN.mjs';