@lunora/runtime 1.0.0-alpha.15 → 1.0.0-alpha.16

package/dist/index.d.mts

@@ -1808,15 +1808,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen

package/dist/index.d.ts

@@ -1808,15 +1808,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BUf56-tZ.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BnZf6iRH.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
@@ -7,7 +7,7 @@ export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK
 export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-ZeZYUPNu.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-HRXo-oOD.mjs';
+export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-igd8FJqk.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-YjvUKisc.mjs';
 

package/dist/packem_shared/{composeWorker-BUf56-tZ.mjs → composeWorker-BnZf6iRH.mjs}

@@ -4,7 +4,7 @@ import { wrapResolverWithContract } from './composeIdentityResolvers-YjvUKisc.mj
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-YjvUKisc.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-HRXo-oOD.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-igd8FJqk.mjs';
 
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
@@ -251,7 +251,7 @@ const buildAuthAdminRoutes = (deps) => {
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
       console.error("[lunora] auth admin operation failed:", error);
-      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
     }
   };
   const handle = async (request, descriptor) => {

package/dist/packem_shared/{decorateResponse-HRXo-oOD.mjs → decorateResponse-igd8FJqk.mjs}

@@ -75,11 +75,10 @@ const resolveCors = (input) => {
   if (typeof origins === "function") {
     isAllowed = origins;
     isExplicitlyAllowed = origins;
-    if (allowCredentials) {
-      console.warn(
-        "@lunora/runtime: security.cors combines a custom `allowedOrigins` predicate with `allowCredentials: true`. Ensure the predicate matches ONLY trusted origins by exact equality — an over-broad predicate (e.g. `() => true`, or `endsWith`/`includes` checks) reflects any origin with credentials, defeating the allowlist and the CSRF guard."
-      );
-    }
+    const credentialsNote = allowCredentials ? " AND reflects matching origins with credentials (`allowCredentials: true`)" : "";
+    console.warn(
+      `@lunora/runtime: security.cors uses a custom \`allowedOrigins\` predicate. It is trusted by the CSRF and WebSocket origin checks${credentialsNote} — ensure it matches ONLY trusted origins by exact equality; an over-broad predicate (e.g. \`() => true\`, or \`endsWith\`/\`includes\` checks) defeats the allowlist.`
+    );
   } else {
     const originsList = origins;
     if (originsList.includes("*") && allowCredentials) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.15",
+  "version": "1.0.0-alpha.16",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",