@lunora/runtime 1.0.0-alpha.11 → 1.0.0-alpha.13

package/dist/index.d.mts

@@ -337,6 +337,116 @@ interface FunctionArgumentDescriptor {
 * kind only — enough for a signature view without a deep recursive walk.
 */
 /**
+* Identity resolved from the inbound request by `WorkerOptions.resolveIdentity`.
+*
+* The `userId` field is special — it becomes `ctx.auth.userId` inside the
+* Durable Object. Any other keys (`email`, `name`, custom roles, etc.) are
+* forwarded verbatim as `ctx.auth.getIdentity()`'s return value.
+*
+* Return `null` to signal that the request is anonymous; the runtime will
+* skip both `x-lunora-userid` and `x-lunora-identity` headers, and
+* `ctx.auth.userId` will be `undefined` on the shard side.
+*/
+interface ResolvedIdentity {
+  /** Arbitrary additional claims. Must be JSON-serialisable. */
+  [key: string]: unknown;
+  /**
+  * JWT-standard expiry in epoch SECONDS. When present (and `expiresAtMs` is
+  * absent), the runtime forwards it as the socket's credential expiry — the
+  * DO drops the socket once it lapses. Used only on the WebSocket path.
+  */
+  exp?: number;
+  /**
+  * Credential expiry in epoch MILLISECONDS. Preferred over `exp` when
+  * both are present. Forwarded as the socket's expiry on the WebSocket path
+  * so the DO drops the socket once it lapses; omit for non-expiring sessions.
+  */
+  expiresAtMs?: number;
+  /** Stable user identifier (e.g. `"user_2k3..."` or `"u_42"`). */
+  userId: string;
+}
+/**
+* A verifier that turns an inbound request into a {@link ResolvedIdentity} (or
+* `null` for anonymous). Structurally identical to `WorkerOptions.resolveIdentity`,
+* so `.auth()`'s better-auth session resolver, a signed-preview-link verifier, a
+* per-tenant bearer check, an upstream-JWT reader, … are all just `IdentityResolver`s
+* — the identity layer is generic over every scheme, not coupled to any one.
+*/
+type IdentityResolver = (request: Request, env: unknown) => Promise<ResolvedIdentity | null> | ResolvedIdentity | null;
+/** Error policy for {@link composeIdentityResolvers} when a participant resolver throws. */
+type ComposeIdentityResolversErrorMode = "fail-closed" | "skip";
+/** Options for {@link composeIdentityResolvers}. */
+interface ComposeIdentityResolversOptions {
+  /**
+  * What to do when a resolver throws. `"fail-closed"` (default, safe)
+  * re-throws so a broken verifier fails the request rather than silently
+  * falling through to a weaker one; `"skip"` swallows the error and tries the
+  * next resolver (use only when a resolver's failure genuinely means "not my
+  * scheme").
+  */
+  readonly onError?: ComposeIdentityResolversErrorMode;
+}
+/**
+* Compose several {@link IdentityResolver}s into one, first-match-wins: each is
+* tried in order and the first that returns a non-null identity short-circuits.
+* Generic over every scheme — the better-auth session resolver (obtained via the
+* builder's `derived.resolveIdentity` escape hatch) is just one entry in the list,
+* so composition never means losing it.
+*
+* A resolver that throws is handled per {@link ComposeIdentityResolversOptions.onError}
+* (default `"fail-closed"`: the error propagates).
+*/
+declare const composeIdentityResolvers: (resolvers: ReadonlyArray<IdentityResolver>, options?: ComposeIdentityResolversOptions) => IdentityResolver;
+/**
+* A thin, generic helper over {@link composeIdentityResolvers} for the per-route case:
+* pick a resolver by `new URL(request.url).pathname`. Keys are matched by longest
+* path prefix; `"*"` is the fallback. Still fully generic — a route→resolver map,
+* with no portal / preview / tenant concepts baked in (those live in the app's
+* own resolvers).
+* @example
+* routeIdentityResolvers({ "/admin": adminResolver, "/partner": partnerResolver, "*": sessionResolver })
+*/
+declare const routeIdentityResolvers: (routes: Record<string, IdentityResolver>) => IdentityResolver;
+/** The result of validating a candidate identity against an {@link IdentityContractLike}. */
+type IdentityValidation = {
+  ok: true;
+} | {
+  error: string;
+  ok: false;
+};
+/**
+* Structural view of `@lunora/server`'s `IdentityContract` (from `defineIdentity`).
+* Kept structural so `@lunora/runtime` stays free of an `@lunora/server` dependency.
+* Keep the `onInvalid` union and `validate`/`IdentityValidation` shapes in sync with
+* `@lunora/server`'s `IdentityContract` — they are projected by hand, not imported.
+* The generated worker entry passes the app's `defineIdentity(...)` result here;
+* the worker validates every resolver's returned claims against it at the trust
+* boundary before they become `ctx.auth`.
+*/
+interface IdentityContractLike {
+  /** Reject policy applied when validation fails: downgrade to anonymous, or reject the request (401). */
+  readonly onInvalid: "anonymous" | "reject";
+  /** Validate resolver-returned claims against the declared contract. */
+  validate: (identity: Record<string, unknown>) => IdentityValidation;
+}
+/**
+* The trust-boundary identity gate. Given the worker's `resolveIdentity` and an
+* optional `defineIdentity(...)` contract, return a resolver that validates every
+* resolved identity against the declared claims BEFORE it becomes `ctx.auth`.
+*
+* Claims arrive from untrusted tokens; a forged / malformed set is either
+* downgraded to anonymous (`onInvalid: "anonymous"`, the safe default — the bad
+* identity never reaches a policy as valid) or rejected with a `401`
+* (`onInvalid: "reject"`), rather than flowing in as an unchecked cast. A valid
+* identity is returned unchanged, so undeclared claims are forwarded verbatim.
+*
+* When no contract is configured (or there is no `resolveIdentity`), the original
+* resolver is returned untouched — zero overhead and byte-identical behaviour.
+* Only the public data paths (RPC / WebSocket / HTTP-action / server-query) use
+* the wrapped resolver; the admin path keeps the raw one (admin is gated by the
+* bearer / Access, not the app's identity contract).
+*/
+/**
 * Observability hooks for the Lunora runtime.
 *
 * A user-supplied {@link ObservabilitySink} receives one event per dispatched
@@ -1223,35 +1333,6 @@ interface HttpRouterLike {
   fetch(request: Request, env?: unknown, context?: ExecutionContextLike): Promise<Response> | Response;
 }
 /**
-* Identity resolved from the inbound request by {@link WorkerOptions.resolveIdentity}.
-*
-* The `userId` field is special — it becomes `ctx.auth.userId` inside the
-* Durable Object. Any other keys (`email`, `name`, custom roles, etc.) are
-* forwarded verbatim as `ctx.auth.getIdentity()`'s return value.
-*
-* Return `null` to signal that the request is anonymous; the runtime will
-* skip both `x-lunora-userid` and `x-lunora-identity` headers, and
-* `ctx.auth.userId` will be `undefined` on the shard side.
-*/
-interface ResolvedIdentity {
-  /** Arbitrary additional claims. Must be JSON-serialisable. */
-  [key: string]: unknown;
-  /**
-  * JWT-standard expiry in epoch SECONDS. When present (and `expiresAtMs` is
-  * absent), the runtime forwards it as the socket's credential expiry — the
-  * DO drops the socket once it lapses. Used only on the WebSocket path.
-  */
-  exp?: number;
-  /**
-  * Credential expiry in epoch MILLISECONDS. Preferred over `exp` when
-  * both are present. Forwarded as the socket's expiry on the WebSocket path
-  * so the DO drops the socket once it lapses; omit for non-expiring sessions.
-  */
-  expiresAtMs?: number;
-  /** Stable user identifier (e.g. `"user_2k3..."` or `"u_42"`). */
-  userId: string;
-}
-/**
 * Per-table sharding metadata the admin import endpoint needs to route rows.
 * Structural so this package stays free of `@lunora/server`. The codegen-
 * generated worker entry passes a thin projection of the user's schema.
@@ -1814,6 +1895,17 @@ interface WorkerOptions {
   */
   httpRouter?: HttpRouterLike;
   /**
+  * The declared identity claim contract (`defineIdentity(...)` from
+  * `@lunora/server`), passed by the generated worker entry. When present, the
+  * worker validates every `resolveIdentity` result against it at the trust
+  * boundary (on the public data paths — RPC / WebSocket / HTTP-action /
+  * server-query, never the admin path) *before* the claims become `ctx.auth`.
+  * A resolver output that violates the contract is downgraded to anonymous or
+  * rejected with a `401`, per the contract's `onInvalid`. Omitted → no
+  * validation, and the identity stays the historical untyped claim bag.
+  */
+  identity?: IdentityContractLike;
+  /**
   * Insert `.global()` rows for the admin import endpoint. When omitted,
   * rows targeting global tables are reported as hard errors.
   */
@@ -2423,4 +2515,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -337,6 +337,116 @@ interface FunctionArgumentDescriptor {
 * kind only — enough for a signature view without a deep recursive walk.
 */
 /**
+* Identity resolved from the inbound request by `WorkerOptions.resolveIdentity`.
+*
+* The `userId` field is special — it becomes `ctx.auth.userId` inside the
+* Durable Object. Any other keys (`email`, `name`, custom roles, etc.) are
+* forwarded verbatim as `ctx.auth.getIdentity()`'s return value.
+*
+* Return `null` to signal that the request is anonymous; the runtime will
+* skip both `x-lunora-userid` and `x-lunora-identity` headers, and
+* `ctx.auth.userId` will be `undefined` on the shard side.
+*/
+interface ResolvedIdentity {
+  /** Arbitrary additional claims. Must be JSON-serialisable. */
+  [key: string]: unknown;
+  /**
+  * JWT-standard expiry in epoch SECONDS. When present (and `expiresAtMs` is
+  * absent), the runtime forwards it as the socket's credential expiry — the
+  * DO drops the socket once it lapses. Used only on the WebSocket path.
+  */
+  exp?: number;
+  /**
+  * Credential expiry in epoch MILLISECONDS. Preferred over `exp` when
+  * both are present. Forwarded as the socket's expiry on the WebSocket path
+  * so the DO drops the socket once it lapses; omit for non-expiring sessions.
+  */
+  expiresAtMs?: number;
+  /** Stable user identifier (e.g. `"user_2k3..."` or `"u_42"`). */
+  userId: string;
+}
+/**
+* A verifier that turns an inbound request into a {@link ResolvedIdentity} (or
+* `null` for anonymous). Structurally identical to `WorkerOptions.resolveIdentity`,
+* so `.auth()`'s better-auth session resolver, a signed-preview-link verifier, a
+* per-tenant bearer check, an upstream-JWT reader, … are all just `IdentityResolver`s
+* — the identity layer is generic over every scheme, not coupled to any one.
+*/
+type IdentityResolver = (request: Request, env: unknown) => Promise<ResolvedIdentity | null> | ResolvedIdentity | null;
+/** Error policy for {@link composeIdentityResolvers} when a participant resolver throws. */
+type ComposeIdentityResolversErrorMode = "fail-closed" | "skip";
+/** Options for {@link composeIdentityResolvers}. */
+interface ComposeIdentityResolversOptions {
+  /**
+  * What to do when a resolver throws. `"fail-closed"` (default, safe)
+  * re-throws so a broken verifier fails the request rather than silently
+  * falling through to a weaker one; `"skip"` swallows the error and tries the
+  * next resolver (use only when a resolver's failure genuinely means "not my
+  * scheme").
+  */
+  readonly onError?: ComposeIdentityResolversErrorMode;
+}
+/**
+* Compose several {@link IdentityResolver}s into one, first-match-wins: each is
+* tried in order and the first that returns a non-null identity short-circuits.
+* Generic over every scheme — the better-auth session resolver (obtained via the
+* builder's `derived.resolveIdentity` escape hatch) is just one entry in the list,
+* so composition never means losing it.
+*
+* A resolver that throws is handled per {@link ComposeIdentityResolversOptions.onError}
+* (default `"fail-closed"`: the error propagates).
+*/
+declare const composeIdentityResolvers: (resolvers: ReadonlyArray<IdentityResolver>, options?: ComposeIdentityResolversOptions) => IdentityResolver;
+/**
+* A thin, generic helper over {@link composeIdentityResolvers} for the per-route case:
+* pick a resolver by `new URL(request.url).pathname`. Keys are matched by longest
+* path prefix; `"*"` is the fallback. Still fully generic — a route→resolver map,
+* with no portal / preview / tenant concepts baked in (those live in the app's
+* own resolvers).
+* @example
+* routeIdentityResolvers({ "/admin": adminResolver, "/partner": partnerResolver, "*": sessionResolver })
+*/
+declare const routeIdentityResolvers: (routes: Record<string, IdentityResolver>) => IdentityResolver;
+/** The result of validating a candidate identity against an {@link IdentityContractLike}. */
+type IdentityValidation = {
+  ok: true;
+} | {
+  error: string;
+  ok: false;
+};
+/**
+* Structural view of `@lunora/server`'s `IdentityContract` (from `defineIdentity`).
+* Kept structural so `@lunora/runtime` stays free of an `@lunora/server` dependency.
+* Keep the `onInvalid` union and `validate`/`IdentityValidation` shapes in sync with
+* `@lunora/server`'s `IdentityContract` — they are projected by hand, not imported.
+* The generated worker entry passes the app's `defineIdentity(...)` result here;
+* the worker validates every resolver's returned claims against it at the trust
+* boundary before they become `ctx.auth`.
+*/
+interface IdentityContractLike {
+  /** Reject policy applied when validation fails: downgrade to anonymous, or reject the request (401). */
+  readonly onInvalid: "anonymous" | "reject";
+  /** Validate resolver-returned claims against the declared contract. */
+  validate: (identity: Record<string, unknown>) => IdentityValidation;
+}
+/**
+* The trust-boundary identity gate. Given the worker's `resolveIdentity` and an
+* optional `defineIdentity(...)` contract, return a resolver that validates every
+* resolved identity against the declared claims BEFORE it becomes `ctx.auth`.
+*
+* Claims arrive from untrusted tokens; a forged / malformed set is either
+* downgraded to anonymous (`onInvalid: "anonymous"`, the safe default — the bad
+* identity never reaches a policy as valid) or rejected with a `401`
+* (`onInvalid: "reject"`), rather than flowing in as an unchecked cast. A valid
+* identity is returned unchanged, so undeclared claims are forwarded verbatim.
+*
+* When no contract is configured (or there is no `resolveIdentity`), the original
+* resolver is returned untouched — zero overhead and byte-identical behaviour.
+* Only the public data paths (RPC / WebSocket / HTTP-action / server-query) use
+* the wrapped resolver; the admin path keeps the raw one (admin is gated by the
+* bearer / Access, not the app's identity contract).
+*/
+/**
 * Observability hooks for the Lunora runtime.
 *
 * A user-supplied {@link ObservabilitySink} receives one event per dispatched
@@ -1223,35 +1333,6 @@ interface HttpRouterLike {
   fetch(request: Request, env?: unknown, context?: ExecutionContextLike): Promise<Response> | Response;
 }
 /**
-* Identity resolved from the inbound request by {@link WorkerOptions.resolveIdentity}.
-*
-* The `userId` field is special — it becomes `ctx.auth.userId` inside the
-* Durable Object. Any other keys (`email`, `name`, custom roles, etc.) are
-* forwarded verbatim as `ctx.auth.getIdentity()`'s return value.
-*
-* Return `null` to signal that the request is anonymous; the runtime will
-* skip both `x-lunora-userid` and `x-lunora-identity` headers, and
-* `ctx.auth.userId` will be `undefined` on the shard side.
-*/
-interface ResolvedIdentity {
-  /** Arbitrary additional claims. Must be JSON-serialisable. */
-  [key: string]: unknown;
-  /**
-  * JWT-standard expiry in epoch SECONDS. When present (and `expiresAtMs` is
-  * absent), the runtime forwards it as the socket's credential expiry — the
-  * DO drops the socket once it lapses. Used only on the WebSocket path.
-  */
-  exp?: number;
-  /**
-  * Credential expiry in epoch MILLISECONDS. Preferred over `exp` when
-  * both are present. Forwarded as the socket's expiry on the WebSocket path
-  * so the DO drops the socket once it lapses; omit for non-expiring sessions.
-  */
-  expiresAtMs?: number;
-  /** Stable user identifier (e.g. `"user_2k3..."` or `"u_42"`). */
-  userId: string;
-}
-/**
 * Per-table sharding metadata the admin import endpoint needs to route rows.
 * Structural so this package stays free of `@lunora/server`. The codegen-
 * generated worker entry passes a thin projection of the user's schema.
@@ -1814,6 +1895,17 @@ interface WorkerOptions {
   */
   httpRouter?: HttpRouterLike;
   /**
+  * The declared identity claim contract (`defineIdentity(...)` from
+  * `@lunora/server`), passed by the generated worker entry. When present, the
+  * worker validates every `resolveIdentity` result against it at the trust
+  * boundary (on the public data paths — RPC / WebSocket / HTTP-action /
+  * server-query, never the admin path) *before* the claims become `ctx.auth`.
+  * A resolver output that violates the contract is downgraded to anonymous or
+  * rejected with a `401`, per the contract's `onInvalid`. Omitted → no
+  * validation, and the identity stays the historical untyped claim bag.
+  */
+  identity?: IdentityContractLike;
+  /**
   * Insert `.global()` rows for the admin import endpoint. When omitted,
   * rows targeting global tables are reported as hard errors.
   */
@@ -2423,4 +2515,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,14 +1,15 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BNYeYQqL.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BOB2YZ6v.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
 export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK8.mjs';
 export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
-export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-Cbds9cUI.mjs';
+export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-ZeZYUPNu.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
 export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DbISh_Wi.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-YjvUKisc.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/composeIdentityResolvers-YjvUKisc.mjs

@@ -0,0 +1,55 @@
+import { LunoraError } from './LunoraError-CL0aOtpo.mjs';
+
+const composeIdentityResolvers = (resolvers, options = {}) => {
+  const onError = options.onError ?? "fail-closed";
+  return async (request, env) => {
+    for (const resolver of resolvers) {
+      let resolved;
+      try {
+        resolved = await resolver(request, env);
+      } catch (error) {
+        if (onError === "skip") {
+          continue;
+        }
+        throw error;
+      }
+      if (resolved) {
+        return resolved;
+      }
+    }
+    return null;
+  };
+};
+const routeIdentityResolvers = (routes) => {
+  const prefixes = Object.keys(routes).filter((key) => key !== "*").toSorted((a, b) => b.length - a.length);
+  return (request, env) => {
+    const { pathname } = new URL(request.url);
+    const matched = prefixes.find((prefix) => pathname === prefix || pathname.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`));
+    const resolver = matched === void 0 ? routes["*"] : routes[matched];
+    if (resolver === void 0) {
+      return null;
+    }
+    return resolver(request, env);
+  };
+};
+const wrapResolverWithContract = (baseResolveIdentity, contract) => {
+  if (contract === void 0 || baseResolveIdentity === void 0) {
+    return baseResolveIdentity;
+  }
+  return async (request, env) => {
+    const resolved = await baseResolveIdentity(request, env);
+    if (!resolved) {
+      return resolved;
+    }
+    const result = contract.validate(resolved);
+    if (result.ok) {
+      return resolved;
+    }
+    if (contract.onInvalid === "reject") {
+      throw new LunoraError(`identity claims failed the declared contract: ${result.error}`, { code: "UNAUTHENTICATED", status: 401 });
+    }
+    return null;
+  };
+};
+
+export { composeIdentityResolvers, routeIdentityResolvers, wrapResolverWithContract };

package/dist/packem_shared/{composeWorker-BNYeYQqL.mjs → composeWorker-BOB2YZ6v.mjs}

@@ -1,5 +1,7 @@
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
 import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
+import { wrapResolverWithContract } from './composeIdentityResolvers-YjvUKisc.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-YjvUKisc.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
 import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
@@ -1836,6 +1838,7 @@ const checkAdminWsToken = (request, expected) => {
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
+  const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
   const shardDO = applyJurisdiction(options.shardDO, options.jurisdiction);
   const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
   let envAdminToken;
@@ -2108,7 +2111,7 @@ const createWorker = (options) => {
     requireAdminOption
   });
   const buildHttpActionContext = async (request, env) => {
-    const { claims, headers, userId } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
     const run = async (reference, args = {}) => {
       const functionPath = reference.__lunoraRef;
       if (typeof functionPath !== "string") {
@@ -2157,7 +2160,7 @@ const createWorker = (options) => {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
     const shardKey = url.searchParams.get("shard") ?? defaultShard;
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(identity, shardKey);
       if (!allowed) {
@@ -2282,7 +2285,7 @@ const createWorker = (options) => {
         status: 400
       });
     }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
     {
       const rpcStartedAt = Date.now();
@@ -2457,7 +2460,7 @@ const createWorker = (options) => {
       if (typeof functionPath !== "string") {
         throw new LunoraError("serverQuery: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
       }
-      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
       await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
       const shardKey = callOptions.shardKey ?? defaultShard;
       return await dispatchSingleShard(functionPath, args, shardKey, forwardedHeaders);

package/dist/packem_shared/{createQueryCoordinator-Cbds9cUI.mjs → createQueryCoordinator-ZeZYUPNu.mjs}

@@ -547,7 +547,16 @@ const mergeTopK = (values, strategy) => {
     }
   }
   const direction = strategy.direction ?? "desc";
-  collected.sort((a, b) => direction === "asc" ? a.score - b.score : b.score - a.score);
+  const ascending = (x, y) => {
+    if (x < y) {
+      return -1;
+    }
+    if (x > y) {
+      return 1;
+    }
+    return 0;
+  };
+  collected.sort((a, b) => direction === "asc" ? ascending(a.score, b.score) : ascending(b.score, a.score));
   return collected.slice(0, strategy.k).map((entry) => entry.row);
 };
 const mergeShardResults = (values, strategy) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.13",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",