@lunora/runtime 0.0.0 → 1.0.0-alpha.2

package/dist/packem_shared/decorateResponse-DbISh_Wi.mjs

@@ -0,0 +1,233 @@
+const DEFAULT_CSP = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+const DEFAULT_PERMISSIONS_POLICY = "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
+const DEFAULT_CORS_HEADERS = ["Authorization", "Content-Type", "X-D1-Bookmark", "X-Lunora-Mutation-Id"];
+const DEFAULT_CORS_METHODS = ["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"];
+const ONE_YEAR_SECONDS = 31536e3;
+const SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+const resolveHstsHeader = (hsts) => {
+  if (hsts === false) {
+    return void 0;
+  }
+  const config = hsts === void 0 || hsts === true ? {} : hsts;
+  const maxAge = config.maxAge ?? ONE_YEAR_SECONDS;
+  const includeSubDomains = config.includeSubDomains ?? true;
+  return `max-age=${String(maxAge)}${includeSubDomains ? "; includeSubDomains" : ""}${config.preload ? "; preload" : ""}`;
+};
+const resolveCspHeader = (csp) => {
+  if (csp === false) {
+    return void 0;
+  }
+  if (typeof csp === "string") {
+    return { htmlToo: true, value: csp };
+  }
+  return { htmlToo: false, value: DEFAULT_CSP };
+};
+const resolveHeaders = (input) => {
+  if (input === false) {
+    return {
+      coop: void 0,
+      csp: void 0,
+      enabled: false,
+      frameOptions: void 0,
+      hsts: void 0,
+      permissionsPolicy: void 0,
+      referrerPolicy: void 0
+    };
+  }
+  const options = input === void 0 || input === true ? {} : input;
+  return {
+    coop: "same-origin",
+    csp: resolveCspHeader(options.csp),
+    enabled: true,
+    frameOptions: options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN",
+    hsts: resolveHstsHeader(options.hsts),
+    permissionsPolicy: options.permissionsPolicy === false ? void 0 : options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY,
+    referrerPolicy: options.referrerPolicy === false ? void 0 : options.referrerPolicy ?? "strict-origin-when-cross-origin"
+  };
+};
+const resolveCors = (input) => {
+  const disabled = {
+    allowCredentials: false,
+    allowedHeaders: DEFAULT_CORS_HEADERS,
+    allowedMethods: DEFAULT_CORS_METHODS,
+    enabled: false,
+    isAllowed: () => false,
+    isExplicitlyAllowed: () => false,
+    maxAge: 600
+  };
+  if (input === void 0 || input === false) {
+    return disabled;
+  }
+  const allowCredentials = input.allowCredentials ?? false;
+  const origins = input.allowedOrigins;
+  let isAllowed;
+  let isExplicitlyAllowed;
+  if (typeof origins === "function") {
+    isAllowed = origins;
+    isExplicitlyAllowed = origins;
+  } else {
+    const originsList = origins;
+    if (originsList.includes("*") && allowCredentials) {
+      throw new Error(
+        '@lunora/runtime: security.cors cannot combine a wildcard origin ("*") with allowCredentials: true — browsers reject it and it defeats the allowlist.'
+      );
+    }
+    isAllowed = (origin) => originsList.includes("*") || originsList.includes(origin);
+    isExplicitlyAllowed = (origin) => originsList.includes(origin);
+  }
+  return {
+    allowCredentials,
+    allowedHeaders: input.allowedHeaders ?? DEFAULT_CORS_HEADERS,
+    allowedMethods: input.allowedMethods ?? DEFAULT_CORS_METHODS,
+    enabled: true,
+    isAllowed,
+    isExplicitlyAllowed,
+    maxAge: input.maxAge ?? 600
+  };
+};
+const resolveCsrf = (input) => {
+  if (input === false) {
+    return { enabled: false, trustedOrigins: [] };
+  }
+  const options = input === void 0 || input === true ? {} : input;
+  return { enabled: true, trustedOrigins: options.trustedOrigins ?? [] };
+};
+const DISABLED_ENV_VALUES = /* @__PURE__ */ new Set(["0", "disabled", "false", "no", "off"]);
+const ENABLED_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
+const isEnvDisabled = (value) => typeof value === "string" && DISABLED_ENV_VALUES.has(value.trim().toLowerCase());
+const isEnvEnabled = (value) => typeof value === "string" && ENABLED_ENV_VALUES.has(value.trim().toLowerCase());
+const parseEnvCors = (env) => {
+  const raw = env?.["LUNORA_ALLOWED_ORIGINS"];
+  if (typeof raw !== "string") {
+    return void 0;
+  }
+  const allowedOrigins = raw.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
+  if (allowedOrigins.length === 0) {
+    return void 0;
+  }
+  const wildcard = allowedOrigins.includes("*");
+  const allowCredentials = !wildcard && isEnvEnabled(env?.["LUNORA_CORS_ALLOW_CREDENTIALS"]);
+  return { allowCredentials, allowedOrigins };
+};
+const resolveSecurity = (security, env) => {
+  const headers = security?.headers ?? (isEnvDisabled(env?.["LUNORA_SECURITY_HEADERS"]) ? false : void 0);
+  const csrf = security?.csrf ?? (isEnvDisabled(env?.["LUNORA_SECURITY_CSRF"]) ? false : void 0);
+  const cors = security?.cors ?? parseEnvCors(env);
+  return {
+    cors: resolveCors(cors),
+    csrf: resolveCsrf(csrf),
+    headers: resolveHeaders(headers)
+  };
+};
+const originOf = (value) => {
+  if (!value) {
+    return void 0;
+  }
+  try {
+    return new URL(value).origin;
+  } catch {
+    return void 0;
+  }
+};
+const isTrustedOrigin = (origin, selfOrigin, resolved) => {
+  if (origin === selfOrigin) {
+    return true;
+  }
+  if (resolved.csrf.trustedOrigins.includes(origin)) {
+    return true;
+  }
+  return resolved.cors.enabled && resolved.cors.isExplicitlyAllowed(origin);
+};
+const enforceOrigin = (request, resolved) => {
+  if (!resolved.csrf.enabled || SAFE_METHODS.has(request.method) || !request.headers.get("cookie")) {
+    return void 0;
+  }
+  const selfOrigin = new URL(request.url).origin;
+  const source = originOf(request.headers.get("origin")) ?? originOf(request.headers.get("referer"));
+  if (source !== void 0 && isTrustedOrigin(source, selfOrigin, resolved)) {
+    return void 0;
+  }
+  return Response.json(
+    { error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin state-changing request rejected" } },
+    { headers: { "content-type": "application/json" }, status: 403 }
+  );
+};
+const corsResponseHeaders = (origin, cors) => {
+  const headers = new Headers();
+  headers.set("access-control-allow-origin", origin);
+  headers.append("vary", "Origin");
+  if (cors.allowCredentials) {
+    headers.set("access-control-allow-credentials", "true");
+  }
+  return headers;
+};
+const handleCorsPreflight = (request, resolved) => {
+  if (!resolved.cors.enabled || request.method !== "OPTIONS") {
+    return void 0;
+  }
+  const origin = request.headers.get("origin");
+  if (!origin || !request.headers.get("access-control-request-method") || !resolved.cors.isAllowed(origin)) {
+    return void 0;
+  }
+  const headers = corsResponseHeaders(origin, resolved.cors);
+  const requested = request.headers.get("access-control-request-headers");
+  headers.set("access-control-allow-methods", resolved.cors.allowedMethods.join(", "));
+  headers.set("access-control-allow-headers", requested ?? resolved.cors.allowedHeaders.join(", "));
+  headers.set("access-control-max-age", String(resolved.cors.maxAge));
+  return new Response(null, { headers, status: 204 });
+};
+const isHtmlResponse = (response) => (response.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
+const setIfAbsent = (headers, name, value) => {
+  if (!headers.has(name)) {
+    headers.set(name, value);
+  }
+};
+const applyBaselineHeaders = (headers, request, response, config) => {
+  if (config.hsts !== void 0 && new URL(request.url).protocol === "https:") {
+    setIfAbsent(headers, "strict-transport-security", config.hsts);
+  }
+  setIfAbsent(headers, "x-content-type-options", "nosniff");
+  if (config.frameOptions !== void 0) {
+    setIfAbsent(headers, "x-frame-options", config.frameOptions);
+  }
+  if (config.referrerPolicy !== void 0) {
+    setIfAbsent(headers, "referrer-policy", config.referrerPolicy);
+  }
+  if (config.permissionsPolicy !== void 0) {
+    setIfAbsent(headers, "permissions-policy", config.permissionsPolicy);
+  }
+  if (config.coop !== void 0) {
+    setIfAbsent(headers, "cross-origin-opener-policy", config.coop);
+  }
+  if (config.csp !== void 0 && (config.csp.htmlToo || !isHtmlResponse(response))) {
+    setIfAbsent(headers, "content-security-policy", config.csp.value);
+  }
+};
+const applyCorsHeaders = (headers, request, cors) => {
+  const origin = request.headers.get("origin");
+  if (!origin || !cors.isAllowed(origin)) {
+    return;
+  }
+  for (const [name, value] of corsResponseHeaders(origin, cors).entries()) {
+    if (name === "vary") {
+      headers.append("vary", value);
+    } else {
+      setIfAbsent(headers, name, value);
+    }
+  }
+};
+const decorateResponse = (response, request, resolved) => {
+  if (response.status === 101 || response.webSocket) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  if (resolved.headers.enabled) {
+    applyBaselineHeaders(headers, request, response, resolved.headers);
+  }
+  if (resolved.cors.enabled) {
+    applyCorsHeaders(headers, request, resolved.cors);
+  }
+  return new Response(response.body, { headers, status: response.status, statusText: response.statusText });
+};
+
+export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity };

package/dist/packem_shared/emitLogEvent-pEdtqAK8.mjs

@@ -0,0 +1,20 @@
+const emitRpcEvent = (sink, event, context) => {
+  if (!sink?.onRpc) {
+    return;
+  }
+  try {
+    sink.onRpc(event, context);
+  } catch {
+  }
+};
+const emitLogEvent = (sink, event, context) => {
+  if (!sink?.onLog) {
+    return;
+  }
+  try {
+    sink.onLog(event, context);
+  } catch {
+  }
+};
+
+export { emitLogEvent, emitRpcEvent };

package/dist/packem_shared/resolveShard-DDkzWtrU.mjs

@@ -0,0 +1,9 @@
+const resolveShard = (namespace, shardKey) => {
+  if (typeof namespace.getByName === "function") {
+    return namespace.getByName(shardKey);
+  }
+  const id = namespace.idFromName(shardKey);
+  return namespace.get(id);
+};
+
+export { resolveShard };

package/dist/packem_shared/toAirbyteMessages-DrHdplb4.mjs

@@ -0,0 +1,39 @@
+const DEFAULT_PRIMARY_KEY = "_id";
+const toFivetranResponse = (page, primaryKey = DEFAULT_PRIMARY_KEY) => {
+  const insert = {};
+  const update = {};
+  const remove = {};
+  const schema = {};
+  const pkFor = (table) => typeof primaryKey === "string" ? primaryKey : primaryKey[table] ?? DEFAULT_PRIMARY_KEY;
+  const bucketFor = (target, table) => {
+    const existing = target[table];
+    if (existing) {
+      return existing;
+    }
+    const created = [];
+    target[table] = created;
+    return created;
+  };
+  for (const change of page.changes) {
+    schema[change.table] ??= { primary_key: [pkFor(change.table)] };
+    if (change.op === "delete") {
+      bucketFor(remove, change.table).push(change.doc);
+    } else if (change.op === "update") {
+      bucketFor(update, change.table).push(change.doc);
+    } else {
+      bucketFor(insert, change.table).push(change.doc);
+    }
+  }
+  return { delete: remove, hasMore: page.hasMore, insert, schema, state: { cursor: page.nextCursor }, update };
+};
+const toAirbyteMessages = (page, emittedAt = Date.now()) => {
+  const messages = [];
+  for (const change of page.changes) {
+    const data = change.op === "delete" ? { ...change.doc, _lunora_deleted: true } : change.doc;
+    messages.push({ record: { data, emitted_at: emittedAt, stream: change.table }, type: "RECORD" });
+  }
+  messages.push({ state: { data: { cursor: page.nextCursor } }, type: "STATE" });
+  return messages;
+};
+
+export { toAirbyteMessages, toFivetranResponse };

package/package.json

@@ -1,31 +1,51 @@
 {
   "name": "@lunora/runtime",
-  "version": "0.0.0",
+  "version": "1.0.0-alpha.2",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
-  "license": "FSL-1.1-Apache-2.0",
+  "keywords": [
+    "cloudflare",
+    "durable-objects",
+    "lunora",
+    "query-coordinator",
+    "rpc",
+    "runtime",
+    "sharding",
+    "workers"
+  ],
   "homepage": "https://lunora.sh",
+  "bugs": "https://github.com/anolilab/lunora/issues",
+  "license": "FSL-1.1-Apache-2.0",
+  "author": {
+    "name": "Daniel Bannert",
+    "email": "d.bannert@anolilab.de"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/anolilab/lunora.git",
     "directory": "packages/runtime"
   },
-  "bugs": {
-    "url": "https://github.com/anolilab/lunora/issues"
-  },
-  "keywords": [
-    "lunora",
-    "cloudflare",
-    "workers",
-    "durable-objects",
-    "rpc",
-    "sharding",
-    "query-coordinator",
-    "runtime"
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE.md",
+    "__assets__"
   ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
   "publishConfig": {
     "access": "public"
   },
-  "files": [
-    "README.md"
-  ]
+  "engines": {
+    "node": "^22.15.0 || >=24.11.0"
+  }
 }