@lunora/errors 1.0.0-alpha.10 → 1.0.0-alpha.11

package/dist/index.d.mts

@@ -208,6 +208,400 @@ declare const ERROR_CATALOG: {
     readonly status: 502;
     readonly title: "Cloudflare Workflows REST API error";
   };
+  /**
+   * Admin-gated `/_lunora/admin/*` and `__lunora_admin__:*` codes. Registered
+   * here (plan 230, ERRORS-01) after an audit found them minted with `code:`
+   * but never added to the catalog — `isInternalCode` fails OPEN for an
+   * unregistered code, so each was already echoing its message unredacted.
+   * Below is that audit's verdict per code, not a blanket allow: most of these
+   * are deliberately actionable ("you forgot to configure X") and stay
+   * client-safe; the ones that can carry backend detail are flagged
+   * `internal: true` individually, with the reason noted alongside.
+   */
+  readonly ADMIN_FORBIDDEN: {
+    readonly status: 403;
+    readonly title: "Admin access forbidden";
+  };
+  readonly ADMIN_TOKEN_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Admin token not configured";
+  };
+  readonly AUTH_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Auth admin not configured";
+  };
+  readonly AUTH_OP_NOT_SUPPORTED: {
+    readonly status: 400;
+    readonly title: "Auth admin operation not supported";
+  };
+  readonly BACKUP_NOT_CONFIGURED: {
+    readonly status: 500;
+    readonly title: "Scheduled backup not configured";
+  };
+  readonly CRON_JOBS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Cron jobs not configured";
+  };
+  readonly CRON_JOB_NOT_FOUND: {
+    readonly status: 404;
+    readonly title: "Cron job not found";
+  };
+  readonly EXPORT_TAP_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Export tap not configured";
+  };
+  readonly FUNCTIONS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Functions registry not configured";
+  };
+  readonly GLOBALS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Global-table introspector not configured";
+  };
+  readonly KV_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "KV introspector not configured";
+  };
+  readonly MIGRATION_ID_REQUIRED: {
+    readonly status: 400;
+    readonly title: "Migration id required";
+  };
+  readonly PITR_UNAVAILABLE: {
+    readonly status: 409;
+    readonly title: "Point-in-time recovery unavailable";
+  };
+  readonly SCHEDULER_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Scheduler not configured";
+  };
+  readonly STORAGE_DELETE_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage delete not configured";
+  };
+  readonly STORAGE_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage not configured";
+  };
+  readonly STORAGE_UPLOAD_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage upload not configured";
+  };
+  readonly STORAGE_URL_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage signed URL not configured";
+  };
+  readonly VECTORS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Vector index introspector not configured";
+  };
+  readonly VECTOR_QUERY_UNSUPPORTED: {
+    readonly status: 400;
+    readonly title: "Vector index querying not enabled";
+  };
+  readonly WORKFLOWS_NOT_CONFIGURED: {
+    readonly status: 501;
+    readonly title: "Workflows not configured";
+  };
+  /** The auth/security audit read plane (`__lunora_admin__:getAuthAuditLog`). */
+  readonly AUTH_AUDIT_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Auth audit reader not configured";
+  };
+  /**
+   * Backend/DB failure reading the auth audit store. The throw site already
+   * keeps the message generic and logs the real error server-side only — flagged
+   * `internal: true` anyway as the deliberate posture for "a backend read
+   * failed", so a future edit that inlines the driver error can't leak it.
+   */
+  readonly AUTH_AUDIT_READ_FAILED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Auth audit read failed";
+  };
+  /**
+   * Cron-job codes. The `*_NOT_STATIC` / `_INVALID` family are codegen
+   * build-time diagnostics — like `CODEGEN_DIAGNOSTIC`, they're thrown as plain
+   * messages into the CLI/Vite-overlay output, never cross the RPC wire, and are
+   * deliberately not `internal` (the message IS the fix). `CRON_JOB_FAILED` is
+   * the one runtime-reachable code in this family — its message interpolates
+   * binding/function/job names from the deployment, so it is flagged internal.
+   */
+  readonly CRON_EXPR_INVALID: {
+    readonly status: 500;
+    readonly title: "Invalid cron expression";
+  };
+  readonly CRON_EXPR_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron expression is not statically analyzable";
+  };
+  readonly CRON_JOB_FAILED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Cron job failed";
+  };
+  readonly CRON_NAME_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron job name is not statically analyzable";
+  };
+  readonly CRON_NON_STATIC_FN: {
+    readonly status: 500;
+    readonly title: "Cron function reference is not statically analyzable";
+  };
+  readonly CRON_NON_STATIC_VALUE: {
+    readonly status: 500;
+    readonly title: "Cron value is not statically analyzable";
+  };
+  readonly CRON_SCHEDULE_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron schedule is not statically analyzable";
+  };
+  readonly DUPLICATE_CRON_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate cron job name";
+  };
+  /** More codegen build-time diagnostics — see the cron-family comment above; same reasoning applies. */
+  readonly DUPLICATE_AGENT_BINDING: {
+    readonly status: 500;
+    readonly title: "Duplicate agent binding";
+  };
+  readonly DUPLICATE_AGENT_CLASS: {
+    readonly status: 500;
+    readonly title: "Duplicate agent generated class name";
+  };
+  readonly DUPLICATE_AGENT_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate agent name";
+  };
+  readonly DUPLICATE_MIGRATION_ID: {
+    readonly status: 500;
+    readonly title: "Duplicate migration id";
+  };
+  readonly DUPLICATE_QUEUE_BINDING: {
+    readonly status: 500;
+    readonly title: "Duplicate queue binding";
+  };
+  readonly DUPLICATE_QUEUE_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate queue name";
+  };
+  readonly DUPLICATE_WORKFLOW_CLASS: {
+    readonly status: 500;
+    readonly title: "Duplicate workflow generated class name";
+  };
+  readonly MIGRATION_ID_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Migration id is not statically analyzable";
+  };
+  readonly NAMESPACE_COLLISION: {
+    readonly status: 500;
+    readonly title: "Function namespace collision";
+  };
+  /**
+   * `@lunora/runtime`'s dispatch/security-boundary codes — RPC/HTTP entry, not
+   * admin-gated. Fixed, non-sensitive messages throughout, so none are `internal`.
+   */
+  readonly BAD_ROW: {
+    readonly status: 400;
+    readonly title: "Malformed import row";
+  };
+  readonly BAD_SUBSCRIPTION_ARGS: {
+    readonly status: 400;
+    readonly title: "Invalid subscription arguments";
+  };
+  readonly BATCH_LIMIT_EXCEEDED: {
+    readonly status: 400;
+    readonly title: "Batch limit exceeded";
+  };
+  readonly CROSS_SHARD_RANK_UNSUPPORTED: {
+    readonly status: 400;
+    readonly title: "Cross-shard rank() is unsupported";
+  };
+  readonly FORBIDDEN_FANOUT: {
+    readonly status: 403;
+    readonly title: "Fan-out forbidden";
+  };
+  readonly FORBIDDEN_ORIGIN: {
+    readonly status: 403;
+    readonly title: "Origin forbidden";
+  };
+  readonly FORBIDDEN_SHARD: {
+    readonly status: 403;
+    readonly title: "Shard access forbidden";
+  };
+  readonly GLOBAL_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Global table import not configured";
+  };
+  readonly INVALID_INPUT: {
+    readonly status: 400;
+    readonly title: "Invalid input";
+  };
+  readonly RATE_LIMITED: {
+    readonly status: 429;
+    readonly title: "Rate limited";
+  };
+  /** Thrown by `@lunora/auth` (Turnstile) and `@lunora/ratelimit` — an upstream dependency didn't respond. Fixed, safe message. */
+  readonly SERVICE_UNAVAILABLE: {
+    readonly status: 503;
+    readonly title: "Service unavailable";
+  };
+  readonly SHAPE_CROSS_SHARD_JOIN: {
+    readonly status: 400;
+    readonly title: "Shape cross-shard join is unsupported";
+  };
+  readonly UNAUTHENTICATED: {
+    readonly status: 401;
+    readonly title: "Unauthenticated";
+  };
+  readonly UNKNOWN_COLUMN: {
+    readonly status: 404;
+    readonly title: "Unknown column";
+  };
+  /**
+   * `@lunora/do`'s ShardDO — WebSocket-frame codes and SQLite-in-DO invariants.
+   * `NESTED_TRANSACTION` and `SQL_UNAVAILABLE` are "should never happen" state
+   * invariants (mirrors `RUN_DEPTH_EXCEEDED`'s posture above): today's message
+   * is static and safe, but flagged internal so a future edit that adds
+   * diagnostic detail can't accidentally start leaking it.
+   */
+  readonly EXPIRED: {
+    readonly status: 404;
+    readonly title: "Session expired";
+  };
+  readonly NESTED_TRANSACTION: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Nested transaction";
+  };
+  readonly OUT_OF_ORDER: {
+    readonly status: 409;
+    readonly title: "Out-of-order mutation";
+  };
+  readonly SHAPE_GLOBAL_TOO_LARGE: {
+    readonly status: 413;
+    readonly title: "Global shape too large";
+  };
+  readonly SHAPE_NOT_FOUND: {
+    readonly status: 404;
+    readonly title: "Shape not found";
+  };
+  readonly SQL_UNAVAILABLE: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "SQL storage unavailable";
+  };
+  readonly TOKEN_EXPIRED: {
+    readonly status: 401;
+    readonly title: "Authentication token expired";
+  };
+  readonly TOO_MANY_STREAMS: {
+    readonly status: 429;
+    readonly title: "Too many streams";
+  };
+  readonly UNKNOWN_ADMIN_OP: {
+    readonly status: 404;
+    readonly title: "Unknown admin operation";
+  };
+  /**
+   * `@lunora/shard-engine`'s relay hub (cross-shard shape relay coordination).
+   * Mirrors `SHARD_ERROR`/`SHARD_UNAVAILABLE` above: operational status for an
+   * app's own relay topology, not a secret — not `internal`.
+   */
+  readonly RELAY_CANNOT_SEED: {
+    readonly status: 500;
+    readonly title: "Relay cannot seed";
+  };
+  readonly RELAY_MISCONFIGURED: {
+    readonly status: 500;
+    readonly title: "Relay misconfigured";
+  };
+  readonly RELAY_SEED_FAILED: {
+    readonly status: 502;
+    readonly title: "Relay seed failed";
+  };
+  /**
+   * A worker option required by the request path is absent (a deploy-config
+   * gap, not a caller error) — the fixed message names the missing option, so
+   * it's actionable and echoed. `MISCONFIGURED` is the one exception: its
+   * message interpolates the caller-supplied `functionPath`, and it's the code
+   * this plan's audit found live-leaking (`create-worker.ts`'s x402 gate).
+   */
+  readonly MISCONFIGURED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Worker misconfigured";
+  };
+  /** `@lunora/nuxt`'s Nitro bridge: the request carried no Cloudflare bindings. Fixed, safe message. */
+  readonly LUNORA_RUNTIME_UNAVAILABLE: {
+    readonly status: 500;
+    readonly title: "Lunora runtime unavailable";
+  };
+  /**
+   * `@lunora/replica`'s event-log Durable Object: generic request-handler
+   * catch-all, mirroring `INTERNAL`/`INTERNAL_SERVER_ERROR`/`RPC_FAILED` above
+   * — the real error is logged server-side only, never in this code's message.
+   */
+  readonly INTERNAL_ERROR: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Internal error";
+  };
+  /**
+   * Client-SDK-only codes (`@lunora/client`), thrown locally in the browser/app
+   * process rather than by the server — `internal`'s wire-redaction semantics
+   * don't apply the same way here, since the "wire" is the app's own code
+   * catching its own client's exception. Kept in the catalog for the client's
+   * `code`-discrimination union and Studio/CLI rendering consistency.
+   */
+  readonly BROWSER_TIMEOUT: {
+    readonly status: 504;
+    readonly title: "Browser operation timed out";
+  };
+  readonly CLIENT_CLOSED: {
+    readonly status: 400;
+    readonly title: "Client is closed";
+  };
+  readonly HTTP_STREAM_BAD_CHUNK: {
+    readonly status: 502;
+    readonly title: "Malformed HTTP stream chunk";
+  };
+  readonly HTTP_STREAM_INTERRUPTED: {
+    readonly status: 502;
+    readonly title: "HTTP stream interrupted";
+  };
+  readonly HTTP_STREAM_MISSING_PARAM: {
+    readonly status: 400;
+    readonly title: "HTTP stream missing path parameter";
+  };
+  readonly HTTP_STREAM_NO_BODY: {
+    readonly status: 502;
+    readonly title: "HTTP stream response has no body";
+  };
+  readonly HTTP_STREAM_STATUS: {
+    readonly status: 502;
+    readonly title: "HTTP stream request failed";
+  };
+  readonly HTTP_STREAM_TRANSPORT: {
+    readonly status: 502;
+    readonly title: "HTTP stream transport error";
+  };
+  readonly STREAM_BACKPRESSURE: {
+    readonly status: 429;
+    readonly title: "Stream backpressure";
+  };
+  readonly STREAM_DISCONNECTED: {
+    readonly status: 503;
+    readonly title: "Stream disconnected";
+  };
+  readonly STREAM_QUEUE_OVERFLOW: {
+    readonly status: 429;
+    readonly title: "Stream queue overflow";
+  };
+  /** `@lunora/db`'s offline outbox: a queued write targeted a collection removed/renamed in a later deploy. */
+  readonly UNKNOWN_MUTATION_FN: {
+    readonly status: 404;
+    readonly title: "Unknown mutation function";
+  };
 };
 /** A well-known Lunora error code (a key of {@link ERROR_CATALOG}). */
 type LunoraErrorCode = keyof typeof ERROR_CATALOG;

package/dist/index.d.ts

@@ -208,6 +208,400 @@ declare const ERROR_CATALOG: {
     readonly status: 502;
     readonly title: "Cloudflare Workflows REST API error";
   };
+  /**
+   * Admin-gated `/_lunora/admin/*` and `__lunora_admin__:*` codes. Registered
+   * here (plan 230, ERRORS-01) after an audit found them minted with `code:`
+   * but never added to the catalog — `isInternalCode` fails OPEN for an
+   * unregistered code, so each was already echoing its message unredacted.
+   * Below is that audit's verdict per code, not a blanket allow: most of these
+   * are deliberately actionable ("you forgot to configure X") and stay
+   * client-safe; the ones that can carry backend detail are flagged
+   * `internal: true` individually, with the reason noted alongside.
+   */
+  readonly ADMIN_FORBIDDEN: {
+    readonly status: 403;
+    readonly title: "Admin access forbidden";
+  };
+  readonly ADMIN_TOKEN_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Admin token not configured";
+  };
+  readonly AUTH_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Auth admin not configured";
+  };
+  readonly AUTH_OP_NOT_SUPPORTED: {
+    readonly status: 400;
+    readonly title: "Auth admin operation not supported";
+  };
+  readonly BACKUP_NOT_CONFIGURED: {
+    readonly status: 500;
+    readonly title: "Scheduled backup not configured";
+  };
+  readonly CRON_JOBS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Cron jobs not configured";
+  };
+  readonly CRON_JOB_NOT_FOUND: {
+    readonly status: 404;
+    readonly title: "Cron job not found";
+  };
+  readonly EXPORT_TAP_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Export tap not configured";
+  };
+  readonly FUNCTIONS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Functions registry not configured";
+  };
+  readonly GLOBALS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Global-table introspector not configured";
+  };
+  readonly KV_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "KV introspector not configured";
+  };
+  readonly MIGRATION_ID_REQUIRED: {
+    readonly status: 400;
+    readonly title: "Migration id required";
+  };
+  readonly PITR_UNAVAILABLE: {
+    readonly status: 409;
+    readonly title: "Point-in-time recovery unavailable";
+  };
+  readonly SCHEDULER_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Scheduler not configured";
+  };
+  readonly STORAGE_DELETE_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage delete not configured";
+  };
+  readonly STORAGE_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage not configured";
+  };
+  readonly STORAGE_UPLOAD_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage upload not configured";
+  };
+  readonly STORAGE_URL_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Storage signed URL not configured";
+  };
+  readonly VECTORS_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Vector index introspector not configured";
+  };
+  readonly VECTOR_QUERY_UNSUPPORTED: {
+    readonly status: 400;
+    readonly title: "Vector index querying not enabled";
+  };
+  readonly WORKFLOWS_NOT_CONFIGURED: {
+    readonly status: 501;
+    readonly title: "Workflows not configured";
+  };
+  /** The auth/security audit read plane (`__lunora_admin__:getAuthAuditLog`). */
+  readonly AUTH_AUDIT_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Auth audit reader not configured";
+  };
+  /**
+   * Backend/DB failure reading the auth audit store. The throw site already
+   * keeps the message generic and logs the real error server-side only — flagged
+   * `internal: true` anyway as the deliberate posture for "a backend read
+   * failed", so a future edit that inlines the driver error can't leak it.
+   */
+  readonly AUTH_AUDIT_READ_FAILED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Auth audit read failed";
+  };
+  /**
+   * Cron-job codes. The `*_NOT_STATIC` / `_INVALID` family are codegen
+   * build-time diagnostics — like `CODEGEN_DIAGNOSTIC`, they're thrown as plain
+   * messages into the CLI/Vite-overlay output, never cross the RPC wire, and are
+   * deliberately not `internal` (the message IS the fix). `CRON_JOB_FAILED` is
+   * the one runtime-reachable code in this family — its message interpolates
+   * binding/function/job names from the deployment, so it is flagged internal.
+   */
+  readonly CRON_EXPR_INVALID: {
+    readonly status: 500;
+    readonly title: "Invalid cron expression";
+  };
+  readonly CRON_EXPR_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron expression is not statically analyzable";
+  };
+  readonly CRON_JOB_FAILED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Cron job failed";
+  };
+  readonly CRON_NAME_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron job name is not statically analyzable";
+  };
+  readonly CRON_NON_STATIC_FN: {
+    readonly status: 500;
+    readonly title: "Cron function reference is not statically analyzable";
+  };
+  readonly CRON_NON_STATIC_VALUE: {
+    readonly status: 500;
+    readonly title: "Cron value is not statically analyzable";
+  };
+  readonly CRON_SCHEDULE_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Cron schedule is not statically analyzable";
+  };
+  readonly DUPLICATE_CRON_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate cron job name";
+  };
+  /** More codegen build-time diagnostics — see the cron-family comment above; same reasoning applies. */
+  readonly DUPLICATE_AGENT_BINDING: {
+    readonly status: 500;
+    readonly title: "Duplicate agent binding";
+  };
+  readonly DUPLICATE_AGENT_CLASS: {
+    readonly status: 500;
+    readonly title: "Duplicate agent generated class name";
+  };
+  readonly DUPLICATE_AGENT_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate agent name";
+  };
+  readonly DUPLICATE_MIGRATION_ID: {
+    readonly status: 500;
+    readonly title: "Duplicate migration id";
+  };
+  readonly DUPLICATE_QUEUE_BINDING: {
+    readonly status: 500;
+    readonly title: "Duplicate queue binding";
+  };
+  readonly DUPLICATE_QUEUE_NAME: {
+    readonly status: 500;
+    readonly title: "Duplicate queue name";
+  };
+  readonly DUPLICATE_WORKFLOW_CLASS: {
+    readonly status: 500;
+    readonly title: "Duplicate workflow generated class name";
+  };
+  readonly MIGRATION_ID_NOT_STATIC: {
+    readonly status: 500;
+    readonly title: "Migration id is not statically analyzable";
+  };
+  readonly NAMESPACE_COLLISION: {
+    readonly status: 500;
+    readonly title: "Function namespace collision";
+  };
+  /**
+   * `@lunora/runtime`'s dispatch/security-boundary codes — RPC/HTTP entry, not
+   * admin-gated. Fixed, non-sensitive messages throughout, so none are `internal`.
+   */
+  readonly BAD_ROW: {
+    readonly status: 400;
+    readonly title: "Malformed import row";
+  };
+  readonly BAD_SUBSCRIPTION_ARGS: {
+    readonly status: 400;
+    readonly title: "Invalid subscription arguments";
+  };
+  readonly BATCH_LIMIT_EXCEEDED: {
+    readonly status: 400;
+    readonly title: "Batch limit exceeded";
+  };
+  readonly CROSS_SHARD_RANK_UNSUPPORTED: {
+    readonly status: 400;
+    readonly title: "Cross-shard rank() is unsupported";
+  };
+  readonly FORBIDDEN_FANOUT: {
+    readonly status: 403;
+    readonly title: "Fan-out forbidden";
+  };
+  readonly FORBIDDEN_ORIGIN: {
+    readonly status: 403;
+    readonly title: "Origin forbidden";
+  };
+  readonly FORBIDDEN_SHARD: {
+    readonly status: 403;
+    readonly title: "Shard access forbidden";
+  };
+  readonly GLOBAL_NOT_CONFIGURED: {
+    readonly status: 400;
+    readonly title: "Global table import not configured";
+  };
+  readonly INVALID_INPUT: {
+    readonly status: 400;
+    readonly title: "Invalid input";
+  };
+  readonly RATE_LIMITED: {
+    readonly status: 429;
+    readonly title: "Rate limited";
+  };
+  /** Thrown by `@lunora/auth` (Turnstile) and `@lunora/ratelimit` — an upstream dependency didn't respond. Fixed, safe message. */
+  readonly SERVICE_UNAVAILABLE: {
+    readonly status: 503;
+    readonly title: "Service unavailable";
+  };
+  readonly SHAPE_CROSS_SHARD_JOIN: {
+    readonly status: 400;
+    readonly title: "Shape cross-shard join is unsupported";
+  };
+  readonly UNAUTHENTICATED: {
+    readonly status: 401;
+    readonly title: "Unauthenticated";
+  };
+  readonly UNKNOWN_COLUMN: {
+    readonly status: 404;
+    readonly title: "Unknown column";
+  };
+  /**
+   * `@lunora/do`'s ShardDO — WebSocket-frame codes and SQLite-in-DO invariants.
+   * `NESTED_TRANSACTION` and `SQL_UNAVAILABLE` are "should never happen" state
+   * invariants (mirrors `RUN_DEPTH_EXCEEDED`'s posture above): today's message
+   * is static and safe, but flagged internal so a future edit that adds
+   * diagnostic detail can't accidentally start leaking it.
+   */
+  readonly EXPIRED: {
+    readonly status: 404;
+    readonly title: "Session expired";
+  };
+  readonly NESTED_TRANSACTION: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Nested transaction";
+  };
+  readonly OUT_OF_ORDER: {
+    readonly status: 409;
+    readonly title: "Out-of-order mutation";
+  };
+  readonly SHAPE_GLOBAL_TOO_LARGE: {
+    readonly status: 413;
+    readonly title: "Global shape too large";
+  };
+  readonly SHAPE_NOT_FOUND: {
+    readonly status: 404;
+    readonly title: "Shape not found";
+  };
+  readonly SQL_UNAVAILABLE: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "SQL storage unavailable";
+  };
+  readonly TOKEN_EXPIRED: {
+    readonly status: 401;
+    readonly title: "Authentication token expired";
+  };
+  readonly TOO_MANY_STREAMS: {
+    readonly status: 429;
+    readonly title: "Too many streams";
+  };
+  readonly UNKNOWN_ADMIN_OP: {
+    readonly status: 404;
+    readonly title: "Unknown admin operation";
+  };
+  /**
+   * `@lunora/shard-engine`'s relay hub (cross-shard shape relay coordination).
+   * Mirrors `SHARD_ERROR`/`SHARD_UNAVAILABLE` above: operational status for an
+   * app's own relay topology, not a secret — not `internal`.
+   */
+  readonly RELAY_CANNOT_SEED: {
+    readonly status: 500;
+    readonly title: "Relay cannot seed";
+  };
+  readonly RELAY_MISCONFIGURED: {
+    readonly status: 500;
+    readonly title: "Relay misconfigured";
+  };
+  readonly RELAY_SEED_FAILED: {
+    readonly status: 502;
+    readonly title: "Relay seed failed";
+  };
+  /**
+   * A worker option required by the request path is absent (a deploy-config
+   * gap, not a caller error) — the fixed message names the missing option, so
+   * it's actionable and echoed. `MISCONFIGURED` is the one exception: its
+   * message interpolates the caller-supplied `functionPath`, and it's the code
+   * this plan's audit found live-leaking (`create-worker.ts`'s x402 gate).
+   */
+  readonly MISCONFIGURED: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Worker misconfigured";
+  };
+  /** `@lunora/nuxt`'s Nitro bridge: the request carried no Cloudflare bindings. Fixed, safe message. */
+  readonly LUNORA_RUNTIME_UNAVAILABLE: {
+    readonly status: 500;
+    readonly title: "Lunora runtime unavailable";
+  };
+  /**
+   * `@lunora/replica`'s event-log Durable Object: generic request-handler
+   * catch-all, mirroring `INTERNAL`/`INTERNAL_SERVER_ERROR`/`RPC_FAILED` above
+   * — the real error is logged server-side only, never in this code's message.
+   */
+  readonly INTERNAL_ERROR: {
+    readonly internal: true;
+    readonly status: 500;
+    readonly title: "Internal error";
+  };
+  /**
+   * Client-SDK-only codes (`@lunora/client`), thrown locally in the browser/app
+   * process rather than by the server — `internal`'s wire-redaction semantics
+   * don't apply the same way here, since the "wire" is the app's own code
+   * catching its own client's exception. Kept in the catalog for the client's
+   * `code`-discrimination union and Studio/CLI rendering consistency.
+   */
+  readonly BROWSER_TIMEOUT: {
+    readonly status: 504;
+    readonly title: "Browser operation timed out";
+  };
+  readonly CLIENT_CLOSED: {
+    readonly status: 400;
+    readonly title: "Client is closed";
+  };
+  readonly HTTP_STREAM_BAD_CHUNK: {
+    readonly status: 502;
+    readonly title: "Malformed HTTP stream chunk";
+  };
+  readonly HTTP_STREAM_INTERRUPTED: {
+    readonly status: 502;
+    readonly title: "HTTP stream interrupted";
+  };
+  readonly HTTP_STREAM_MISSING_PARAM: {
+    readonly status: 400;
+    readonly title: "HTTP stream missing path parameter";
+  };
+  readonly HTTP_STREAM_NO_BODY: {
+    readonly status: 502;
+    readonly title: "HTTP stream response has no body";
+  };
+  readonly HTTP_STREAM_STATUS: {
+    readonly status: 502;
+    readonly title: "HTTP stream request failed";
+  };
+  readonly HTTP_STREAM_TRANSPORT: {
+    readonly status: 502;
+    readonly title: "HTTP stream transport error";
+  };
+  readonly STREAM_BACKPRESSURE: {
+    readonly status: 429;
+    readonly title: "Stream backpressure";
+  };
+  readonly STREAM_DISCONNECTED: {
+    readonly status: 503;
+    readonly title: "Stream disconnected";
+  };
+  readonly STREAM_QUEUE_OVERFLOW: {
+    readonly status: 429;
+    readonly title: "Stream queue overflow";
+  };
+  /** `@lunora/db`'s offline outbox: a queued write targeted a collection removed/renamed in a later deploy. */
+  readonly UNKNOWN_MUTATION_FN: {
+    readonly status: 404;
+    readonly title: "Unknown mutation function";
+  };
 };
 /** A well-known Lunora error code (a key of {@link ERROR_CATALOG}). */
 type LunoraErrorCode = keyof typeof ERROR_CATALOG;

package/dist/index.mjs

@@ -1 +1 @@
-import{LunoraError as e}from"./packem_shared/LunoraError-Bi0eJQ64.mjs";import{CLOUDFLARE_PLATFORM_ERRORS as t,ERROR_CATALOG as i,MESSAGE_SOLUTIONS as a,findCloudflarePlatformSolution as f,findIssueSolution as l,findSolutionByMessage as u,flattenHint as E,isInternalCode as R,resolveHint as S}from"./packem_shared/CLOUDFLARE_PLATFORM_ERRORS-AwchC1Yo.mjs";import{isLunoraError as L}from"./packem_shared/isLunoraError-Dvew97xn.mjs";import{invariant as d,unreachable as m}from"./packem_shared/invariant-HTyw4bqA.mjs";import{toErrorBody as x}from"./packem_shared/toErrorBody-Bodp1HTL.mjs";export{t as CLOUDFLARE_PLATFORM_ERRORS,i as ERROR_CATALOG,e as LunoraError,a as MESSAGE_SOLUTIONS,f as findCloudflarePlatformSolution,l as findIssueSolution,u as findSolutionByMessage,E as flattenHint,d as invariant,R as isInternalCode,L as isLunoraError,S as resolveHint,x as toErrorBody,m as unreachable};
+import{LunoraError as e}from"./packem_shared/LunoraError-MUTWZDbD.mjs";import{CLOUDFLARE_PLATFORM_ERRORS as t,ERROR_CATALOG as i,MESSAGE_SOLUTIONS as a,findCloudflarePlatformSolution as f,findIssueSolution as l,findSolutionByMessage as u,flattenHint as E,isInternalCode as R,resolveHint as S}from"./packem_shared/CLOUDFLARE_PLATFORM_ERRORS-D98lVLGc.mjs";import{isLunoraError as L}from"./packem_shared/isLunoraError-Dvew97xn.mjs";import{invariant as d,unreachable as m}from"./packem_shared/invariant-CnwAr0oB.mjs";import{toErrorBody as x}from"./packem_shared/toErrorBody-l1H3-utl.mjs";export{t as CLOUDFLARE_PLATFORM_ERRORS,i as ERROR_CATALOG,e as LunoraError,a as MESSAGE_SOLUTIONS,f as findCloudflarePlatformSolution,l as findIssueSolution,u as findSolutionByMessage,E as flattenHint,d as invariant,R as isInternalCode,L as isLunoraError,S as resolveHint,x as toErrorBody,m as unreachable};

package/dist/packem_shared/{CLOUDFLARE_PLATFORM_ERRORS-AwchC1Yo.mjs → CLOUDFLARE_PLATFORM_ERRORS-D98lVLGc.mjs}

@@ -1,4 +1,4 @@
-const o="https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/",a="https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/",s={BAD_REQUEST:{status:400,title:"Bad request"},UNAUTHORIZED:{status:401,title:"Unauthorized"},FORBIDDEN:{status:403,title:"Forbidden"},NOT_FOUND:{status:404,title:"Not found"},CONFLICT:{hint:["Another write changed this row while your mutation was running (optimistic concurrency conflict).","","Re-read the row and retry the mutation with the fresh value. Lunora serializes a DO's mutations, so a persistent conflict usually means the handler conflicts **with itself** (e.g. a trigger or cascade touching the same row) — split that work rather than adding a retry loop."],status:409,title:"Conflict"},NOT_UNIQUE:{hint:["`.unique()` matched more than one document — it expects the query to identify at most one row.","","- If several matches are legitimate, use `.first()` (take one) or `.collect()` (take all) instead.","- Otherwise tighten the query (e.g. filter on a unique/indexed field) so it can only match one row."],status:400,title:"Query matched more than one document"},VALIDATION_ERROR:{status:400,title:"Validation failed"},TOO_MANY_REQUESTS:{status:429,title:"Too many requests"},UNPROCESSABLE:{status:422,title:"Unprocessable"},NOT_IMPLEMENTED:{status:501,title:"Not implemented"},FUNCTION_NOT_FOUND:{status:404,title:"Function not found"},METHOD_NOT_ALLOWED:{status:405,title:"Method not allowed"},PAYLOAD_TOO_LARGE:{status:413,title:"Payload too large"},INTERNAL:{internal:!0,status:500,title:"Internal error"},INTERNAL_SERVER_ERROR:{internal:!0,status:500,title:"Internal error"},RPC_FAILED:{internal:!0,status:500,title:"Internal error"},COUNT_RLS_UNSUPPORTED:{status:422,title:"count() is unsupported under an RLS policy"},MASK_UNSUPPORTED:{status:422,title:"Aggregation over a masked column is unsupported"},RELATION_PREDICATE_UNSUPPORTED:{status:422,title:"Relation predicate is unsupported in a write policy"},RLS_REQUIRED:{hint:["This table is secure-by-default: it has no `.public()` marker and no RLS policy resolved for the caller, so the read fails closed.","","Add a read policy with `.rls(...)`, or mark the table `.public()` if it is intentionally world-readable."],status:403,title:"RLS policy required"},RUN_DEPTH_EXCEEDED:{internal:!0,status:500,title:"Run depth exceeded"},TRANSACTION_LIMIT_EXCEEDED:{hint:["A single mutation may only read and write a bounded amount before it is stopped.","","Narrow the read with an index (`.withIndex(...)`) instead of scanning the table, or split the write across several mutations — for a large backfill use `defineMigration` + `lunora migrate up`, which batches and checkpoints for you.","","The ceilings are deliberately conservative — they exist to stop one request taking down the whole shard. A deployment that genuinely needs bigger transactions can raise them by overriding the `transactionLimits()` seam on its generated shard class."],status:413,title:"Transaction limit exceeded"},MIGRATION_NOT_FOUND:{status:404,title:"Data migration not found"},UNKNOWN_TABLE:{status:404,title:"Unknown table"},GLOBAL_TABLE_NOT_EDITABLE:{status:400,title:"Global table is not editable"},SHARD_ERROR:{status:503,title:"Shard error"},SHARD_UNAVAILABLE:{status:503,title:"Shard unavailable"},OFFLINE_IDENTITY_CHANGED:{status:409,title:"Offline identity changed"},CODEGEN_DIAGNOSTIC:{status:500,title:"Codegen diagnostic"},SCHEMA_SNAPSHOT_PARSE:{status:500,title:"Schema snapshot parse error"},ENV_INVALID:{internal:!0,status:500,title:"Invalid environment"},AUTH_HEADERS_MISSING:{internal:!0,status:500,title:"Auth headers missing"},EMAIL_DOMAIN_BLOCKED:{hint:["This address's domain is on the disposable/throwaway blocklist (or your configured deny-list).","","Sign up with a permanent mailbox. To tune the policy, pass `blockDisposable` / `allowDomains` / `denyDomains` to `emailGate(...)` (`@lunora/auth/email-guard`)."],status:400,title:"Email domain not allowed"},EMAIL_UNDELIVERABLE:{hint:["The address's domain publishes no MX (or fallback A/AAAA) records, so it can't receive mail.","","Check for a typo in the domain. MX verification is opt-in (`mx: true`) and needs DNS — leave it off on the edge path if DNS is unavailable."],status:400,title:"Email domain cannot receive mail"},ANALYTICS_SQL_ERROR:{status:502,title:"Analytics Engine SQL API error"},R2_SQL_ERROR:{status:502,title:"R2 SQL API error"},WORKFLOWS_REST_ERROR:{status:502,title:"Cloudflare Workflows REST API error"}},h=e=>Object.hasOwn(s,e)?s[e]:void 0,b=e=>h(e)?.internal===!0,f=[{body:["Lunora codegen couldn't find a schema to generate from.","","Create `lunora/schema.ts` exporting a `defineSchema(...)` call:","","```ts",'import { defineSchema, defineTable, v } from "@lunora/server";',"","export default defineSchema({","  messages: defineTable({ body: v.string() }),","});","```","","Or run `lunora init` to scaffold Lunora (a sample `lunora/schema.ts` included) into your app."].join(`
+const a="https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/",r="https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/",s={BAD_REQUEST:{status:400,title:"Bad request"},UNAUTHORIZED:{status:401,title:"Unauthorized"},FORBIDDEN:{status:403,title:"Forbidden"},NOT_FOUND:{status:404,title:"Not found"},CONFLICT:{hint:["Another write changed this row while your mutation was running (optimistic concurrency conflict).","","Re-read the row and retry the mutation with the fresh value. Lunora serializes a DO's mutations, so a persistent conflict usually means the handler conflicts **with itself** (e.g. a trigger or cascade touching the same row) — split that work rather than adding a retry loop."],status:409,title:"Conflict"},NOT_UNIQUE:{hint:["`.unique()` matched more than one document — it expects the query to identify at most one row.","","- If several matches are legitimate, use `.first()` (take one) or `.collect()` (take all) instead.","- Otherwise tighten the query (e.g. filter on a unique/indexed field) so it can only match one row."],status:400,title:"Query matched more than one document"},VALIDATION_ERROR:{status:400,title:"Validation failed"},TOO_MANY_REQUESTS:{status:429,title:"Too many requests"},UNPROCESSABLE:{status:422,title:"Unprocessable"},NOT_IMPLEMENTED:{status:501,title:"Not implemented"},FUNCTION_NOT_FOUND:{status:404,title:"Function not found"},METHOD_NOT_ALLOWED:{status:405,title:"Method not allowed"},PAYLOAD_TOO_LARGE:{status:413,title:"Payload too large"},INTERNAL:{internal:!0,status:500,title:"Internal error"},INTERNAL_SERVER_ERROR:{internal:!0,status:500,title:"Internal error"},RPC_FAILED:{internal:!0,status:500,title:"Internal error"},COUNT_RLS_UNSUPPORTED:{status:422,title:"count() is unsupported under an RLS policy"},MASK_UNSUPPORTED:{status:422,title:"Aggregation over a masked column is unsupported"},RELATION_PREDICATE_UNSUPPORTED:{status:422,title:"Relation predicate is unsupported in a write policy"},RLS_REQUIRED:{hint:["This table is secure-by-default: it has no `.public()` marker and no RLS policy resolved for the caller, so the read fails closed.","","Add a read policy with `.rls(...)`, or mark the table `.public()` if it is intentionally world-readable."],status:403,title:"RLS policy required"},RUN_DEPTH_EXCEEDED:{internal:!0,status:500,title:"Run depth exceeded"},TRANSACTION_LIMIT_EXCEEDED:{hint:["A single mutation may only read and write a bounded amount before it is stopped.","","Narrow the read with an index (`.withIndex(...)`) instead of scanning the table, or split the write across several mutations — for a large backfill use `defineMigration` + `lunora migrate up`, which batches and checkpoints for you.","","The ceilings are deliberately conservative — they exist to stop one request taking down the whole shard. A deployment that genuinely needs bigger transactions can raise them by overriding the `transactionLimits()` seam on its generated shard class."],status:413,title:"Transaction limit exceeded"},MIGRATION_NOT_FOUND:{status:404,title:"Data migration not found"},UNKNOWN_TABLE:{status:404,title:"Unknown table"},GLOBAL_TABLE_NOT_EDITABLE:{status:400,title:"Global table is not editable"},SHARD_ERROR:{status:503,title:"Shard error"},SHARD_UNAVAILABLE:{status:503,title:"Shard unavailable"},OFFLINE_IDENTITY_CHANGED:{status:409,title:"Offline identity changed"},CODEGEN_DIAGNOSTIC:{status:500,title:"Codegen diagnostic"},SCHEMA_SNAPSHOT_PARSE:{status:500,title:"Schema snapshot parse error"},ENV_INVALID:{internal:!0,status:500,title:"Invalid environment"},AUTH_HEADERS_MISSING:{internal:!0,status:500,title:"Auth headers missing"},EMAIL_DOMAIN_BLOCKED:{hint:["This address's domain is on the disposable/throwaway blocklist (or your configured deny-list).","","Sign up with a permanent mailbox. To tune the policy, pass `blockDisposable` / `allowDomains` / `denyDomains` to `emailGate(...)` (`@lunora/auth/email-guard`)."],status:400,title:"Email domain not allowed"},EMAIL_UNDELIVERABLE:{hint:["The address's domain publishes no MX (or fallback A/AAAA) records, so it can't receive mail.","","Check for a typo in the domain. MX verification is opt-in (`mx: true`) and needs DNS — leave it off on the edge path if DNS is unavailable."],status:400,title:"Email domain cannot receive mail"},ANALYTICS_SQL_ERROR:{status:502,title:"Analytics Engine SQL API error"},R2_SQL_ERROR:{status:502,title:"R2 SQL API error"},WORKFLOWS_REST_ERROR:{status:502,title:"Cloudflare Workflows REST API error"},ADMIN_FORBIDDEN:{status:403,title:"Admin access forbidden"},ADMIN_TOKEN_NOT_CONFIGURED:{status:400,title:"Admin token not configured"},AUTH_NOT_CONFIGURED:{status:400,title:"Auth admin not configured"},AUTH_OP_NOT_SUPPORTED:{status:400,title:"Auth admin operation not supported"},BACKUP_NOT_CONFIGURED:{status:500,title:"Scheduled backup not configured"},CRON_JOBS_NOT_CONFIGURED:{status:400,title:"Cron jobs not configured"},CRON_JOB_NOT_FOUND:{status:404,title:"Cron job not found"},EXPORT_TAP_NOT_CONFIGURED:{status:400,title:"Export tap not configured"},FUNCTIONS_NOT_CONFIGURED:{status:400,title:"Functions registry not configured"},GLOBALS_NOT_CONFIGURED:{status:400,title:"Global-table introspector not configured"},KV_NOT_CONFIGURED:{status:400,title:"KV introspector not configured"},MIGRATION_ID_REQUIRED:{status:400,title:"Migration id required"},PITR_UNAVAILABLE:{status:409,title:"Point-in-time recovery unavailable"},SCHEDULER_NOT_CONFIGURED:{status:400,title:"Scheduler not configured"},STORAGE_DELETE_NOT_CONFIGURED:{status:400,title:"Storage delete not configured"},STORAGE_NOT_CONFIGURED:{status:400,title:"Storage not configured"},STORAGE_UPLOAD_NOT_CONFIGURED:{status:400,title:"Storage upload not configured"},STORAGE_URL_NOT_CONFIGURED:{status:400,title:"Storage signed URL not configured"},VECTORS_NOT_CONFIGURED:{status:400,title:"Vector index introspector not configured"},VECTOR_QUERY_UNSUPPORTED:{status:400,title:"Vector index querying not enabled"},WORKFLOWS_NOT_CONFIGURED:{status:501,title:"Workflows not configured"},AUTH_AUDIT_NOT_CONFIGURED:{status:400,title:"Auth audit reader not configured"},AUTH_AUDIT_READ_FAILED:{internal:!0,status:500,title:"Auth audit read failed"},CRON_EXPR_INVALID:{status:500,title:"Invalid cron expression"},CRON_EXPR_NOT_STATIC:{status:500,title:"Cron expression is not statically analyzable"},CRON_JOB_FAILED:{internal:!0,status:500,title:"Cron job failed"},CRON_NAME_NOT_STATIC:{status:500,title:"Cron job name is not statically analyzable"},CRON_NON_STATIC_FN:{status:500,title:"Cron function reference is not statically analyzable"},CRON_NON_STATIC_VALUE:{status:500,title:"Cron value is not statically analyzable"},CRON_SCHEDULE_NOT_STATIC:{status:500,title:"Cron schedule is not statically analyzable"},DUPLICATE_CRON_NAME:{status:500,title:"Duplicate cron job name"},DUPLICATE_AGENT_BINDING:{status:500,title:"Duplicate agent binding"},DUPLICATE_AGENT_CLASS:{status:500,title:"Duplicate agent generated class name"},DUPLICATE_AGENT_NAME:{status:500,title:"Duplicate agent name"},DUPLICATE_MIGRATION_ID:{status:500,title:"Duplicate migration id"},DUPLICATE_QUEUE_BINDING:{status:500,title:"Duplicate queue binding"},DUPLICATE_QUEUE_NAME:{status:500,title:"Duplicate queue name"},DUPLICATE_WORKFLOW_CLASS:{status:500,title:"Duplicate workflow generated class name"},MIGRATION_ID_NOT_STATIC:{status:500,title:"Migration id is not statically analyzable"},NAMESPACE_COLLISION:{status:500,title:"Function namespace collision"},BAD_ROW:{status:400,title:"Malformed import row"},BAD_SUBSCRIPTION_ARGS:{status:400,title:"Invalid subscription arguments"},BATCH_LIMIT_EXCEEDED:{status:400,title:"Batch limit exceeded"},CROSS_SHARD_RANK_UNSUPPORTED:{status:400,title:"Cross-shard rank() is unsupported"},FORBIDDEN_FANOUT:{status:403,title:"Fan-out forbidden"},FORBIDDEN_ORIGIN:{status:403,title:"Origin forbidden"},FORBIDDEN_SHARD:{status:403,title:"Shard access forbidden"},GLOBAL_NOT_CONFIGURED:{status:400,title:"Global table import not configured"},INVALID_INPUT:{status:400,title:"Invalid input"},RATE_LIMITED:{status:429,title:"Rate limited"},SERVICE_UNAVAILABLE:{status:503,title:"Service unavailable"},SHAPE_CROSS_SHARD_JOIN:{status:400,title:"Shape cross-shard join is unsupported"},UNAUTHENTICATED:{status:401,title:"Unauthenticated"},UNKNOWN_COLUMN:{status:404,title:"Unknown column"},EXPIRED:{status:404,title:"Session expired"},NESTED_TRANSACTION:{internal:!0,status:500,title:"Nested transaction"},OUT_OF_ORDER:{status:409,title:"Out-of-order mutation"},SHAPE_GLOBAL_TOO_LARGE:{status:413,title:"Global shape too large"},SHAPE_NOT_FOUND:{status:404,title:"Shape not found"},SQL_UNAVAILABLE:{internal:!0,status:500,title:"SQL storage unavailable"},TOKEN_EXPIRED:{status:401,title:"Authentication token expired"},TOO_MANY_STREAMS:{status:429,title:"Too many streams"},UNKNOWN_ADMIN_OP:{status:404,title:"Unknown admin operation"},RELAY_CANNOT_SEED:{status:500,title:"Relay cannot seed"},RELAY_MISCONFIGURED:{status:500,title:"Relay misconfigured"},RELAY_SEED_FAILED:{status:502,title:"Relay seed failed"},MISCONFIGURED:{internal:!0,status:500,title:"Worker misconfigured"},LUNORA_RUNTIME_UNAVAILABLE:{status:500,title:"Lunora runtime unavailable"},INTERNAL_ERROR:{internal:!0,status:500,title:"Internal error"},BROWSER_TIMEOUT:{status:504,title:"Browser operation timed out"},CLIENT_CLOSED:{status:400,title:"Client is closed"},HTTP_STREAM_BAD_CHUNK:{status:502,title:"Malformed HTTP stream chunk"},HTTP_STREAM_INTERRUPTED:{status:502,title:"HTTP stream interrupted"},HTTP_STREAM_MISSING_PARAM:{status:400,title:"HTTP stream missing path parameter"},HTTP_STREAM_NO_BODY:{status:502,title:"HTTP stream response has no body"},HTTP_STREAM_STATUS:{status:502,title:"HTTP stream request failed"},HTTP_STREAM_TRANSPORT:{status:502,title:"HTTP stream transport error"},STREAM_BACKPRESSURE:{status:429,title:"Stream backpressure"},STREAM_DISCONNECTED:{status:503,title:"Stream disconnected"},STREAM_QUEUE_OVERFLOW:{status:429,title:"Stream queue overflow"},UNKNOWN_MUTATION_FN:{status:404,title:"Unknown mutation function"}},h=e=>Object.hasOwn(s,e)?s[e]:void 0,N=e=>h(e)?.internal===!0,f=[{body:["Lunora codegen couldn't find a schema to generate from.","","Create `lunora/schema.ts` exporting a `defineSchema(...)` call:","","```ts",'import { defineSchema, defineTable, v } from "@lunora/server";',"","export default defineSchema({","  messages: defineTable({ body: v.string() }),","});","```","","Or run `lunora init` to scaffold Lunora (a sample `lunora/schema.ts` included) into your app."].join(`
 `),header:"No Lunora schema found",id:"lunora-schema-missing",test:e=>e.includes("defineSchema() not found")||e.includes("schema.ts not found at")},{body:["`defineSchema(...)` must be called with an **inline object literal** mapping table names to `defineTable(...)`:","","```ts","export default defineSchema({","  todos: defineTable({ title: v.string(), done: v.boolean() }),","});","```","","Codegen reads the schema statically, so it can't follow a variable or a spread — pass the object literal directly."].join(`
 `),header:"`defineSchema()` needs an inline object literal",id:"lunora-schema-not-object-literal",test:e=>e.includes("defineSchema() expects an object literal")},{body:["This table name collides with a built-in `ctx.db` member, so the generated client can't expose it.","","Rename the table to anything that isn't a reserved name (the error lists them) — e.g. `userAccounts` instead of `insert`."].join(`
 `),header:"Table name is reserved",id:"lunora-table-reserved",test:e=>e.includes("is reserved")&&e.includes("ctx.db")},{body:["Two tables resolve to the same name — usually a base table and a schema **extension** both defining it.","","Rename one of them, or drop the duplicate from the extension. Each table name must be unique across `defineSchema(...)` and every `.extend(...)`."].join(`
@@ -7,8 +7,8 @@ const o="https://developers.cloudflare.com/support/troubleshooting/http-status-c
 `),header:"`unique` must be a literal",id:"lunora-unique-literal",test:e=>e.includes("must be a literal")&&e.includes("unique")},{body:["A declared container/workflow class isn't re-exported by your worker entry, so `wrangler deploy` would reject it.","","Add the generated re-export shown in the error to your worker entry (e.g. `src/index.ts`):","","```ts",'export * from "./lunora/_generated/containers";',"```"].join(`
 `),header:"Binding not exported by your worker entry",id:"lunora-worker-entry-export-gap",test:e=>e.includes("not exported by your worker entry")},{body:["A row with the same value already exists in a `unique` index.","","- If you meant to upsert, use `ctx.db.<table>().upsert(...)` (or `.patch(...)` an existing row) instead of `.insert(...)`.",`- Otherwise pick a value that isn't already taken, and consider surfacing a friendly "already exists" message to the user.`].join(`
 `),header:"Unique constraint violation",id:"lunora-runtime-unique",test:e=>e.includes("unique constraint violation on")},{body:s.CONFLICT.hint.join(`
-`),header:"Optimistic concurrency conflict",id:"lunora-runtime-occ",test:e=>e.includes("optimistic concurrency conflict")}],u=[{causes:"the origin returned an empty, unknown, or malformed response Cloudflare couldn't interpret (often an origin crash or an oversized response header)",code:"520",docsUrl:o,family:"5xx",fix:"check your origin's logs for a crash, ensure it returns a valid HTTP response, and keep response headers under the size limit",summary:"Cloudflare got an unknown/empty response from your origin web server.",title:"Web server returns an unknown error"},{causes:"the origin refused the connection — the web server is down, or a firewall is blocking Cloudflare's IP ranges",code:"521",docsUrl:o,family:"5xx",fix:"confirm the origin process is running and allowlist Cloudflare's published IP ranges in your firewall/security groups",summary:"Cloudflare could not connect to your origin because it refused the connection.",title:"Web server is down"},{causes:"Cloudflare could not establish a TCP connection to the origin in time — the origin is overloaded, a firewall is dropping packets, or the origin IP is wrong",code:"522",docsUrl:o,family:"5xx",fix:"verify the origin is reachable and not overloaded, and that the DNS record points at the correct origin IP",summary:"The connection to your origin timed out before it was established.",title:"Connection timed out"},{causes:"Cloudflare cannot route to the origin at all — a bad DNS record, an origin IP that changed, or invalid routing",code:"523",docsUrl:o,family:"5xx",fix:"verify the DNS A/AAAA record points at a reachable origin IP and that no upstream network is blocking Cloudflare",summary:"Cloudflare could not reach your origin server.",title:"Origin is unreachable"},{causes:"Cloudflare made a TCP connection but the origin did not return an HTTP response within 100 seconds — a slow handler or long-running request",code:"524",docsUrl:o,family:"5xx",fix:"speed up the slow origin handler, or move long work off the request path into a background job (a Durable Object, Queue, or Workflow)",summary:"Cloudflare connected to your origin but it did not respond in time.",title:"A timeout occurred"},{causes:"the TLS handshake between Cloudflare and the origin failed — a missing/invalid origin certificate, or a cipher/SNI mismatch under Full (Strict) SSL",code:"525",docsUrl:o,family:"5xx",fix:"install a valid certificate on the origin and align your Cloudflare SSL/TLS mode with the origin's certificate setup",summary:"The SSL handshake with your origin failed.",title:"SSL handshake failed"},{causes:"Cloudflare could not validate the origin's certificate under Full (Strict) SSL — it is expired, self-signed, or issued for the wrong hostname",code:"526",docsUrl:o,family:"5xx",fix:"install a valid, publicly-trusted certificate on the origin (or use a Cloudflare Origin CA cert), matching the request hostname",summary:"Cloudflare could not validate your origin's SSL certificate.",title:"Invalid SSL certificate"},{causes:"a DNS record points at a Cloudflare IP or another prohibited address instead of your real origin",code:"1000",docsUrl:a,family:"1xxx",fix:"point the DNS record at your real origin IP, not a Cloudflare-owned or loopback address",summary:"DNS points to a prohibited IP.",title:"DNS points to prohibited IP"},{causes:"Cloudflare could not resolve the requested hostname — a Worker fetched an unresolvable host, or a DNS record is misconfigured",code:"1001",docsUrl:a,family:"1xxx",fix:"check the hostname you're requesting and the DNS records for the zone resolve to a valid origin",summary:"Cloudflare could not resolve the origin DNS.",title:"DNS resolution error"},{causes:"a Worker or DNS record targets a restricted IP (for example a Cloudflare-owned or loopback address)",code:"1002",docsUrl:a,family:"1xxx",fix:"change the Worker fetch target or DNS record to a valid, non-restricted origin address",summary:"DNS points to a prohibited IP (Worker/restricted).",title:"DNS points to a prohibited IP"},{causes:"the visitor's IP was blocked by an IP Access Rule, WAF rule, or security configuration on the zone",code:"1006",docsUrl:a,family:"1xxx",fix:"review the zone's Firewall/WAF and IP Access Rules to see why the address was banned, and adjust if it was blocked in error",summary:"Access denied: the visitor's IP has been banned.",title:"Access denied: your IP has been banned"},{causes:"your Worker threw an unhandled JavaScript exception during the request",code:"1101",docsUrl:a,family:"1xxx",fix:"reproduce with `wrangler tail` (or the Workers Logs / Studio Logs panel) to get the stack trace, then handle the throwing code path",summary:"A Worker threw a JavaScript exception.",title:"Worker threw a JavaScript exception"},{causes:"the Worker used more CPU time than a single invocation is allowed — usually a hot loop or heavy synchronous work",code:"1102",docsUrl:a,family:"1xxx",fix:"reduce per-request CPU (optimize hot loops, avoid heavy synchronous work) or offload the heavy work to a Durable Object, Queue, or Workflow",summary:"A Worker exceeded its CPU-time resource limit.",title:"Worker exceeded resource limits"}],l=e=>e!==void 0&&e>="0"&&e<="9",m=(e,t)=>{for(let r=e.indexOf(t);r!==-1;r=e.indexOf(t,r+t.length))if(!l(e[r-1])&&!l(e[r+t.length]))return!0;return!1},g=(e,t)=>{for(const r of[`error ${t}`,`error: ${t}`])for(let i=e.indexOf(r);i!==-1;i=e.indexOf(r,i+r.length))if(!l(e[i+r.length]))return!0;return!1},p=/error|cloudflare/iu,c=e=>({body:[e.summary,"",`**Likely cause:** ${e.causes}.`,"",`**Fix:** ${e.fix}.`,"",`See [Cloudflare's ${e.family} error docs](${e.docsUrl}).`].join(`
-`),header:`Cloudflare Error ${e.code}: ${e.title}`,id:`cloudflare-error-${e.code}`}),y=e=>{if(!p.test(e))return;const t=e.toLowerCase(),r=t.includes("error"),i=t.includes("cloudflare");if(r){for(const n of u)if(g(t,n.code))return c(n)}if(i){for(const n of u)if(m(t,n.code))return c(n)}},x=e=>(typeof e=="string"?e:e.join(`
+`),header:"Optimistic concurrency conflict",id:"lunora-runtime-occ",test:e=>e.includes("optimistic concurrency conflict")}],d=[{causes:"the origin returned an empty, unknown, or malformed response Cloudflare couldn't interpret (often an origin crash or an oversized response header)",code:"520",docsUrl:a,family:"5xx",fix:"check your origin's logs for a crash, ensure it returns a valid HTTP response, and keep response headers under the size limit",summary:"Cloudflare got an unknown/empty response from your origin web server.",title:"Web server returns an unknown error"},{causes:"the origin refused the connection — the web server is down, or a firewall is blocking Cloudflare's IP ranges",code:"521",docsUrl:a,family:"5xx",fix:"confirm the origin process is running and allowlist Cloudflare's published IP ranges in your firewall/security groups",summary:"Cloudflare could not connect to your origin because it refused the connection.",title:"Web server is down"},{causes:"Cloudflare could not establish a TCP connection to the origin in time — the origin is overloaded, a firewall is dropping packets, or the origin IP is wrong",code:"522",docsUrl:a,family:"5xx",fix:"verify the origin is reachable and not overloaded, and that the DNS record points at the correct origin IP",summary:"The connection to your origin timed out before it was established.",title:"Connection timed out"},{causes:"Cloudflare cannot route to the origin at all — a bad DNS record, an origin IP that changed, or invalid routing",code:"523",docsUrl:a,family:"5xx",fix:"verify the DNS A/AAAA record points at a reachable origin IP and that no upstream network is blocking Cloudflare",summary:"Cloudflare could not reach your origin server.",title:"Origin is unreachable"},{causes:"Cloudflare made a TCP connection but the origin did not return an HTTP response within 100 seconds — a slow handler or long-running request",code:"524",docsUrl:a,family:"5xx",fix:"speed up the slow origin handler, or move long work off the request path into a background job (a Durable Object, Queue, or Workflow)",summary:"Cloudflare connected to your origin but it did not respond in time.",title:"A timeout occurred"},{causes:"the TLS handshake between Cloudflare and the origin failed — a missing/invalid origin certificate, or a cipher/SNI mismatch under Full (Strict) SSL",code:"525",docsUrl:a,family:"5xx",fix:"install a valid certificate on the origin and align your Cloudflare SSL/TLS mode with the origin's certificate setup",summary:"The SSL handshake with your origin failed.",title:"SSL handshake failed"},{causes:"Cloudflare could not validate the origin's certificate under Full (Strict) SSL — it is expired, self-signed, or issued for the wrong hostname",code:"526",docsUrl:a,family:"5xx",fix:"install a valid, publicly-trusted certificate on the origin (or use a Cloudflare Origin CA cert), matching the request hostname",summary:"Cloudflare could not validate your origin's SSL certificate.",title:"Invalid SSL certificate"},{causes:"a DNS record points at a Cloudflare IP or another prohibited address instead of your real origin",code:"1000",docsUrl:r,family:"1xxx",fix:"point the DNS record at your real origin IP, not a Cloudflare-owned or loopback address",summary:"DNS points to a prohibited IP.",title:"DNS points to prohibited IP"},{causes:"Cloudflare could not resolve the requested hostname — a Worker fetched an unresolvable host, or a DNS record is misconfigured",code:"1001",docsUrl:r,family:"1xxx",fix:"check the hostname you're requesting and the DNS records for the zone resolve to a valid origin",summary:"Cloudflare could not resolve the origin DNS.",title:"DNS resolution error"},{causes:"a Worker or DNS record targets a restricted IP (for example a Cloudflare-owned or loopback address)",code:"1002",docsUrl:r,family:"1xxx",fix:"change the Worker fetch target or DNS record to a valid, non-restricted origin address",summary:"DNS points to a prohibited IP (Worker/restricted).",title:"DNS points to a prohibited IP"},{causes:"the visitor's IP was blocked by an IP Access Rule, WAF rule, or security configuration on the zone",code:"1006",docsUrl:r,family:"1xxx",fix:"review the zone's Firewall/WAF and IP Access Rules to see why the address was banned, and adjust if it was blocked in error",summary:"Access denied: the visitor's IP has been banned.",title:"Access denied: your IP has been banned"},{causes:"your Worker threw an unhandled JavaScript exception during the request",code:"1101",docsUrl:r,family:"1xxx",fix:"reproduce with `wrangler tail` (or the Workers Logs / Studio Logs panel) to get the stack trace, then handle the throwing code path",summary:"A Worker threw a JavaScript exception.",title:"Worker threw a JavaScript exception"},{causes:"the Worker used more CPU time than a single invocation is allowed — usually a hot loop or heavy synchronous work",code:"1102",docsUrl:r,family:"1xxx",fix:"reduce per-request CPU (optimize hot loops, avoid heavy synchronous work) or offload the heavy work to a Durable Object, Queue, or Workflow",summary:"A Worker exceeded its CPU-time resource limit.",title:"Worker exceeded resource limits"}],l=e=>e!==void 0&&e>="0"&&e<="9",m=(e,t)=>{for(let i=e.indexOf(t);i!==-1;i=e.indexOf(t,i+t.length))if(!l(e[i-1])&&!l(e[i+t.length]))return!0;return!1},_=(e,t)=>{for(const i of[`error ${t}`,`error: ${t}`])for(let o=e.indexOf(i);o!==-1;o=e.indexOf(i,o+i.length))if(!l(e[o+i.length]))return!0;return!1},E=/error|cloudflare/iu,c=e=>({body:[e.summary,"",`**Likely cause:** ${e.causes}.`,"",`**Fix:** ${e.fix}.`,"",`See [Cloudflare's ${e.family} error docs](${e.docsUrl}).`].join(`
+`),header:`Cloudflare Error ${e.code}: ${e.title}`,id:`cloudflare-error-${e.code}`}),T=e=>{if(!E.test(e))return;const t=e.toLowerCase(),i=t.includes("error"),o=t.includes("cloudflare");if(i){for(const n of d)if(_(t,n.code))return c(n)}if(o){for(const n of d)if(m(t,n.code))return c(n)}},A=e=>(typeof e=="string"?e:e.join(`
 `)).split(`
 `).filter(t=>!t.startsWith("```")).join(`
-`).replaceAll(/\*\*(.+?)\*\*/gu,"$1").replaceAll(/`([^`]+)`/gu,"$1"),d=e=>{for(const t of f)if(t.test(e))return{body:t.body,header:t.header,id:t.id}},S=e=>d(e)??y(e),w=e=>{if(typeof e=="string")return d(e)?.body;if(e.hint!==void 0)return e.hint;if(e.code!==void 0){const t=h(e.code);if(t?.hint!==void 0)return t.hint}return e.message===void 0?void 0:d(e.message)?.body};export{u as CLOUDFLARE_PLATFORM_ERRORS,s as ERROR_CATALOG,f as MESSAGE_SOLUTIONS,y as findCloudflarePlatformSolution,S as findIssueSolution,d as findSolutionByMessage,x as flattenHint,h as getCatalogEntry,b as isInternalCode,w as resolveHint};
+`).replaceAll(/\*\*(.+?)\*\*/gu,"$1").replaceAll(/`([^`]+)`/gu,"$1"),u=e=>{for(const t of f)if(t.test(e))return{body:t.body,header:t.header,id:t.id}},O=e=>u(e)??T(e),p=e=>{if(typeof e=="string")return u(e)?.body;if(e.hint!==void 0)return e.hint;if(e.code!==void 0){const t=h(e.code);if(t?.hint!==void 0)return t.hint}return e.message===void 0?void 0:u(e.message)?.body};export{d as CLOUDFLARE_PLATFORM_ERRORS,s as ERROR_CATALOG,f as MESSAGE_SOLUTIONS,T as findCloudflarePlatformSolution,O as findIssueSolution,u as findSolutionByMessage,A as flattenHint,h as getCatalogEntry,N as isInternalCode,p as resolveHint};

package/dist/packem_shared/{LunoraError-Bi0eJQ64.mjs → LunoraError-MUTWZDbD.mjs}

@@ -1 +1 @@
-import{getCatalogEntry as i}from"./CLOUDFLARE_PLATFORM_ERRORS-AwchC1Yo.mjs";class c extends Error{type="VisulimaError";hint;title;loc;code;status;docsUrl;data;constructor(o,a,t={}){const s=i(o);super(a??o,t.cause===void 0?void 0:{cause:t.cause}),this.name=t.name??"LunoraError",this.hint=t.hint??s?.hint,this.title=t.title??s?.title,this.loc=t.location,this.code=o,this.status=t.status??s?.status??500,this.docsUrl=t.docsUrl??s?.docsUrl,this.data=t.data}}export{c as LunoraError};
+import{getCatalogEntry as i}from"./CLOUDFLARE_PLATFORM_ERRORS-D98lVLGc.mjs";class c extends Error{type="VisulimaError";hint;title;loc;code;status;docsUrl;data;constructor(o,a,t={}){const s=i(o);super(a??o,t.cause===void 0?void 0:{cause:t.cause}),this.name=t.name??"LunoraError",this.hint=t.hint??s?.hint,this.title=t.title??s?.title,this.loc=t.location,this.code=o,this.status=t.status??s?.status??500,this.docsUrl=t.docsUrl??s?.docsUrl,this.data=t.data}}export{c as LunoraError};

package/dist/packem_shared/{invariant-HTyw4bqA.mjs → invariant-CnwAr0oB.mjs}

@@ -1 +1 @@
-import{LunoraError as n}from"./LunoraError-Bi0eJQ64.mjs";const t=(r,a)=>{if(!r)throw new n("INTERNAL",a,{name:"InvariantError"})},e=r=>{throw new n("INTERNAL",r,{name:"InvariantError"})};export{t as invariant,e as unreachable};
+import{LunoraError as n}from"./LunoraError-MUTWZDbD.mjs";const t=(r,a)=>{if(!r)throw new n("INTERNAL",a,{name:"InvariantError"})},e=r=>{throw new n("INTERNAL",r,{name:"InvariantError"})};export{t as invariant,e as unreachable};

package/dist/packem_shared/{toErrorBody-Bodp1HTL.mjs → toErrorBody-l1H3-utl.mjs}

@@ -1 +1 @@
-import{isInternalCode as a,resolveHint as r}from"./CLOUDFLARE_PLATFORM_ERRORS-AwchC1Yo.mjs";import{isLunoraError as c}from"./isLunoraError-Dvew97xn.mjs";const u=(o,d={})=>{const s=d.redactedMessage??"Internal error";if(c(o)){if(a(o.code))return{body:{code:o.code,message:s},redacted:!0,status:o.status};const e={code:o.code,message:o.message};o.data!==void 0&&d.encodeData!==void 0&&(e.data=d.encodeData(o.data));const t=r({code:o.code,hint:o.hint,message:o.message});return t!==void 0&&(e.hint=t),o.docsUrl!==void 0&&(e.docsUrl=o.docsUrl),{body:e,redacted:!1,status:o.status}}return{body:{code:d.fallbackCode??"INTERNAL",message:s},redacted:!0,status:500}};export{u as toErrorBody};
+import{isInternalCode as a,resolveHint as r}from"./CLOUDFLARE_PLATFORM_ERRORS-D98lVLGc.mjs";import{isLunoraError as c}from"./isLunoraError-Dvew97xn.mjs";const u=(o,d={})=>{const s=d.redactedMessage??"Internal error";if(c(o)){if(a(o.code))return{body:{code:o.code,message:s},redacted:!0,status:o.status};const e={code:o.code,message:o.message};o.data!==void 0&&d.encodeData!==void 0&&(e.data=d.encodeData(o.data));const t=r({code:o.code,hint:o.hint,message:o.message});return t!==void 0&&(e.hint=t),o.docsUrl!==void 0&&(e.docsUrl=o.docsUrl),{body:e,redacted:!1,status:o.status}}return{body:{code:d.fallbackCode??"INTERNAL",message:s},redacted:!0,status:500}};export{u as toErrorBody};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/errors",
-  "version": "1.0.0-alpha.10",
+  "version": "1.0.0-alpha.11",
   "description": "Unified error layer for Lunora: one LunoraError base + a central catalog of codes, statuses, and actionable hints, rendered across CLI, overlay, Studio, and the client",
   "keywords": [
     "cloudflare",