@lunora/runtime 1.0.0-alpha.15 → 1.0.0-alpha.17

package/dist/index.d.mts

@@ -1,6 +1,7 @@
 import { RankDirection, RankPageRow, DatabaseWriterLike } from '@lunora/do';
 export type { RankDirection as RankPageDirection, RankPageRowKey as RankPageKey, RankPageRow, ShardRankPageResult } from '@lunora/do';
 import { WorkflowsRestClient } from '@lunora/workflow';
+import { LunoraError as LunoraError$1, ErrorBody } from '@lunora/errors';
 /**
 * Turn-key incremental-sync source helpers for warehouse connectors
 * (Fivetran custom functions, Airbyte incremental sources).
@@ -1194,24 +1195,6 @@ interface ShardTrafficFanOutResult {
   shards: ReadonlyArray<ShardTrafficEntry>;
 }
 declare const createQueryCoordinator: (options: QueryCoordinatorOptions) => QueryCoordinator;
-/**
-* Secure-by-default HTTP edge for the Lunora worker.
-*
-* The worker's top-level `fetch` (see `./create-worker`) is the single choke
-* point every response passes through — RPC, auth, admin, `httpRoute` handlers,
-* and the SSR fallback alike. This module supplies what is applied there:
-* `decorateResponse` adds baseline security headers plus, for allowed
-* cross-origin requests, the matching `Access-Control-Allow-*` headers (never
-* overwriting a header the inner handler set); `handleCorsPreflight` answers
-* `OPTIONS` preflights for allowlisted origins; `enforceOrigin` is a CSRF guard
-* that rejects state-changing, cookie-authenticated requests from untrusted
-* origins.
-*
-* Every layer is on by default and individually disable-able through the
-* `SecurityOptions` passed to `createWorker`. Resolution (`resolveSecurity`) is
-* pure and platform-agnostic — it touches only the global `Request`/`Response`/
-* `Headers`/`URL`, so it unit-tests under plain Node without workerd.
-*/
 /** Per-header overrides for {@link SecurityHeadersOptions}. `false` omits the header. */
 interface SecurityHeadersOptions {
   /**
@@ -1808,15 +1791,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen
@@ -2463,18 +2450,30 @@ interface DynamicShardRegistry extends ShardRegistry {
 }
 declare const createDynamicShardRegistry: (options: DynamicShardRegistryOptions) => DynamicShardRegistry;
 interface LunoraErrorBody {
-  error: {
-    code: string;
-    message: string;
-  };
+  error: ErrorBody;
 }
 /**
-* Error type recognised by the runtime's error middleware. Anything thrown
-* that isn't a `LunoraError` is mapped to a generic 500 with code `INTERNAL`.
+* Convert any thrown value into a JSON error response.
+*
+* Delegates the envelope + redaction to `@lunora/errors`' {@link toErrorBody} —
+* a non-internal `LunoraError` (from `@lunora/server`, this runtime, or the
+* `@lunora/do` data layer) is echoed with its `code`/`message`/`hint`/`docsUrl`;
+* an internal-coded error keeps its status but its message is redacted; anything
+* else becomes a generic `INTERNAL` 500. All of these share the unified shape
+* recognized by `isLunoraError`.
+*/
+declare const toErrorResponse: (error: unknown) => Response;
+/**
+* Transport-level error for the worker entry. A thin ergonomic wrapper over the
+* shared `@lunora/errors` `LunoraError` that keeps the runtime's historical
+* `(message, { code, status })` signature — the runtime mints these with
+* dispatch-specific codes (`METHOD_NOT_ALLOWED`, `*_NOT_CONFIGURED`, …) and an
+* explicit status, so they don't need a central catalog entry. Because it is a
+* real `LunoraError`, it carries the unified wire shape and is recognized by
+* `isLunoraError` everywhere. Anything thrown that isn't a `LunoraError`
+* is mapped to a generic 500 with code `INTERNAL`.
 */
-declare class LunoraError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class LunoraError extends LunoraError$1 {
   constructor(message: string, options?: {
     cause?: unknown;
     code?: string;
@@ -2482,10 +2481,6 @@ declare class LunoraError extends Error {
   });
   toResponse(): Response;
 }
-/** Shape recognised by the runtime's structural error checks. */
-
-/** Convert any thrown value into a JSON error response. */
-declare const toErrorResponse: (error: unknown) => Response;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { RankDirection, RankPageRow, DatabaseWriterLike } from '@lunora/do';
 export type { RankDirection as RankPageDirection, RankPageRowKey as RankPageKey, RankPageRow, ShardRankPageResult } from '@lunora/do';
 import { WorkflowsRestClient } from '@lunora/workflow';
+import { LunoraError as LunoraError$1, ErrorBody } from '@lunora/errors';
 /**
 * Turn-key incremental-sync source helpers for warehouse connectors
 * (Fivetran custom functions, Airbyte incremental sources).
@@ -1194,24 +1195,6 @@ interface ShardTrafficFanOutResult {
   shards: ReadonlyArray<ShardTrafficEntry>;
 }
 declare const createQueryCoordinator: (options: QueryCoordinatorOptions) => QueryCoordinator;
-/**
-* Secure-by-default HTTP edge for the Lunora worker.
-*
-* The worker's top-level `fetch` (see `./create-worker`) is the single choke
-* point every response passes through — RPC, auth, admin, `httpRoute` handlers,
-* and the SSR fallback alike. This module supplies what is applied there:
-* `decorateResponse` adds baseline security headers plus, for allowed
-* cross-origin requests, the matching `Access-Control-Allow-*` headers (never
-* overwriting a header the inner handler set); `handleCorsPreflight` answers
-* `OPTIONS` preflights for allowlisted origins; `enforceOrigin` is a CSRF guard
-* that rejects state-changing, cookie-authenticated requests from untrusted
-* origins.
-*
-* Every layer is on by default and individually disable-able through the
-* `SecurityOptions` passed to `createWorker`. Resolution (`resolveSecurity`) is
-* pure and platform-agnostic — it touches only the global `Request`/`Response`/
-* `Headers`/`URL`, so it unit-tests under plain Node without workerd.
-*/
 /** Per-header overrides for {@link SecurityHeadersOptions}. `false` omits the header. */
 interface SecurityHeadersOptions {
   /**
@@ -1808,15 +1791,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen
@@ -2463,18 +2450,30 @@ interface DynamicShardRegistry extends ShardRegistry {
 }
 declare const createDynamicShardRegistry: (options: DynamicShardRegistryOptions) => DynamicShardRegistry;
 interface LunoraErrorBody {
-  error: {
-    code: string;
-    message: string;
-  };
+  error: ErrorBody;
 }
 /**
-* Error type recognised by the runtime's error middleware. Anything thrown
-* that isn't a `LunoraError` is mapped to a generic 500 with code `INTERNAL`.
+* Convert any thrown value into a JSON error response.
+*
+* Delegates the envelope + redaction to `@lunora/errors`' {@link toErrorBody} —
+* a non-internal `LunoraError` (from `@lunora/server`, this runtime, or the
+* `@lunora/do` data layer) is echoed with its `code`/`message`/`hint`/`docsUrl`;
+* an internal-coded error keeps its status but its message is redacted; anything
+* else becomes a generic `INTERNAL` 500. All of these share the unified shape
+* recognized by `isLunoraError`.
+*/
+declare const toErrorResponse: (error: unknown) => Response;
+/**
+* Transport-level error for the worker entry. A thin ergonomic wrapper over the
+* shared `@lunora/errors` `LunoraError` that keeps the runtime's historical
+* `(message, { code, status })` signature — the runtime mints these with
+* dispatch-specific codes (`METHOD_NOT_ALLOWED`, `*_NOT_CONFIGURED`, …) and an
+* explicit status, so they don't need a central catalog entry. Because it is a
+* real `LunoraError`, it carries the unified wire shape and is recognized by
+* `isLunoraError` everywhere. Anything thrown that isn't a `LunoraError`
+* is mapped to a generic 500 with code `INTERNAL`.
 */
-declare class LunoraError extends Error {
-  readonly code: string;
-  readonly status: number;
+declare class LunoraError extends LunoraError$1 {
   constructor(message: string, options?: {
     cause?: unknown;
     code?: string;
@@ -2482,10 +2481,6 @@ declare class LunoraError extends Error {
   });
   toResponse(): Response;
 }
-/** Shape recognised by the runtime's structural error checks. */
-
-/** Convert any thrown value into a JSON error response. */
-declare const toErrorResponse: (error: unknown) => Response;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */

package/dist/index.mjs

@@ -1,15 +1,15 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BUf56-tZ.mjs';
-export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
-export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
-export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-DU8vDrgA.mjs';
+export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
+export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
+export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';
 export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK8.mjs';
 export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
-export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-ZeZYUPNu.mjs';
+export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-DNCJzOZE.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-HRXo-oOD.mjs';
+export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-CsZc49QC.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-YjvUKisc.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-XGjO7V1J.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/{DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs → DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
 import { applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
 
 const SHARD_REGISTRY_DO_NAME = "__lunora_shard_registry__";
@@ -42,7 +43,7 @@ const createDynamicShardRegistry = (options) => {
       }
       const response = await get(`/list?table=${encodeURIComponent(table)}`);
       if (!response.ok) {
-        throw new Error(`shard registry /list returned ${String(response.status)}`);
+        throw new LunoraError(`shard registry /list returned ${String(response.status)}`);
       }
       const { shardKeys } = await decodeJson(response);
       if (cacheTtlMs > 0) {
@@ -53,14 +54,14 @@ const createDynamicShardRegistry = (options) => {
     async register(table, shardKey) {
       const response = await post("/register", { shardKey, table });
       if (!response.ok) {
-        throw new Error(`shard registry /register returned ${String(response.status)}`);
+        throw new LunoraError(`shard registry /register returned ${String(response.status)}`);
       }
       cache.delete(table);
     },
     async snapshot() {
       const response = await get("/snapshot");
       if (!response.ok) {
-        throw new Error(`shard registry /snapshot returned ${String(response.status)}`);
+        throw new LunoraError(`shard registry /snapshot returned ${String(response.status)}`);
       }
       const { tables } = await decodeJson(response);
       return tables;
@@ -68,7 +69,7 @@ const createDynamicShardRegistry = (options) => {
     async unregister(table, shardKey) {
       const response = await post("/unregister", { shardKey, table });
       if (!response.ok) {
-        throw new Error(`shard registry /unregister returned ${String(response.status)}`);
+        throw new LunoraError(`shard registry /unregister returned ${String(response.status)}`);
       }
       cache.delete(table);
     }

package/dist/packem_shared/LunoraError-Bpb9EFJ3.mjs

@@ -0,0 +1,22 @@
+import { LunoraError as LunoraError$1, toErrorBody } from '@lunora/errors';
+
+const toErrorResponse = (error) => {
+  const { body, redacted, status } = toErrorBody(error, { fallbackCode: "INTERNAL", redactedMessage: "Internal error" });
+  if (redacted) {
+    console.error("[lunora] internal error:", error);
+  }
+  return Response.json({ error: body }, {
+    headers: { "content-type": "application/json" },
+    status
+  });
+};
+class LunoraError extends LunoraError$1 {
+  constructor(message, options) {
+    super(options?.code ?? "INTERNAL", message, { cause: options?.cause, status: options?.status });
+  }
+  toResponse() {
+    return toErrorResponse(this);
+  }
+}
+
+export { LunoraError, toErrorResponse };

package/dist/packem_shared/{composeIdentityResolvers-YjvUKisc.mjs → composeIdentityResolvers-XGjO7V1J.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-CL0aOtpo.mjs';
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
 
 const composeIdentityResolvers = (resolvers, options = {}) => {
   const onError = options.onError ?? "fail-closed";

package/dist/packem_shared/{composeWorker-BUf56-tZ.mjs → composeWorker-DU8vDrgA.mjs}

@@ -1,10 +1,11 @@
+import { isLunoraError } from '@lunora/errors';
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
-import { wrapResolverWithContract } from './composeIdentityResolvers-YjvUKisc.mjs';
-export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-YjvUKisc.mjs';
+import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
+import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-HRXo-oOD.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-CsZc49QC.mjs';
 
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
@@ -251,7 +252,7 @@ const buildAuthAdminRoutes = (deps) => {
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
       console.error("[lunora] auth admin operation failed:", error);
-      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
     }
   };
   const handle = async (request, descriptor) => {
@@ -1740,7 +1741,7 @@ const isAuthAttemptPath = (pathname, basePath) => {
   return AUTH_ATTEMPT_SEGMENTS.some((segment) => suffix === segment || suffix.startsWith(`${segment}/`));
 };
 const buildErrorEvent = (functionPath, durationMs, error, extra) => {
-  const mappable = error instanceof LunoraError || isStructuralLunoraError(error) || isStructuralConflictError(error);
+  const mappable = isLunoraError(error);
   const code = mappable ? error.code : "INTERNAL_SERVER_ERROR";
   const status = mappable ? error.status : 500;
   const message = error instanceof Error ? error.message : String(error);
@@ -2911,7 +2912,7 @@ const resolveLunoraOptions = (options, env) => {
   }
   const shardDO = options.shardDO ?? env?.SHARD;
   if (!shardDO) {
-    throw new Error(
+    throw new LunoraError(
       "@lunora/runtime: no shard Durable Object namespace found. Bind `SHARD` in wrangler.jsonc, or pass `createLunoraHandler({ shardDO: env.MY_SHARD })`."
     );
   }

package/dist/packem_shared/{createCrossShardRelationCapabilities-C0KOf7er.mjs → createCrossShardRelationCapabilities-CbcWjkAn.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
+
 const RPC_ENDPOINT = "/_lunora/rpc";
 const buildIdentityHeaders = (options) => {
   const headers = { "content-type": "application/json" };
@@ -19,12 +21,12 @@ const fanOutRelation = async (options, body, label) => {
     })
   );
   if (!response.ok) {
-    throw new Error(`cross-shard relation ${label} failed: worker returned ${String(response.status)}`);
+    throw new LunoraError(`cross-shard relation ${label} failed: worker returned ${String(response.status)}`);
   }
   const result = await response.json();
   if (typeof result.failed === "number" && result.failed > 0) {
     const reached = (typeof result.ok === "number" ? result.ok : 0) + result.failed;
-    throw new Error(
+    throw new LunoraError(
       `cross-shard relation ${label} failed on ${String(result.failed)} of ${String(reached)} shard(s) — refusing to return a partial result`
     );
   }

package/dist/packem_shared/{createQueryCoordinator-ZeZYUPNu.mjs → createQueryCoordinator-DNCJzOZE.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-CL0aOtpo.mjs';
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
 import { resolveShard } from './applyJurisdiction-BkZtTkct.mjs';
 
 const createStaticShardRegistry = (table_to_keys) => {

package/dist/packem_shared/{decorateResponse-HRXo-oOD.mjs → decorateResponse-CsZc49QC.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
+
 const DEFAULT_CSP = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
 const htmlCspFor = (frameOptions) => {
   const parts = ["base-uri 'none'", "object-src 'none'"];
@@ -75,15 +77,14 @@ const resolveCors = (input) => {
   if (typeof origins === "function") {
     isAllowed = origins;
     isExplicitlyAllowed = origins;
-    if (allowCredentials) {
-      console.warn(
-        "@lunora/runtime: security.cors combines a custom `allowedOrigins` predicate with `allowCredentials: true`. Ensure the predicate matches ONLY trusted origins by exact equality — an over-broad predicate (e.g. `() => true`, or `endsWith`/`includes` checks) reflects any origin with credentials, defeating the allowlist and the CSRF guard."
-      );
-    }
+    const credentialsNote = allowCredentials ? " AND reflects matching origins with credentials (`allowCredentials: true`)" : "";
+    console.warn(
+      `@lunora/runtime: security.cors uses a custom \`allowedOrigins\` predicate. It is trusted by the CSRF and WebSocket origin checks${credentialsNote} — ensure it matches ONLY trusted origins by exact equality; an over-broad predicate (e.g. \`() => true\`, or \`endsWith\`/\`includes\` checks) defeats the allowlist.`
+    );
   } else {
     const originsList = origins;
     if (originsList.includes("*") && allowCredentials) {
-      throw new Error(
+      throw new LunoraError(
         '@lunora/runtime: security.cors cannot combine a wildcard origin ("*") with allowCredentials: true — browsers reject it and it defeats the allowlist.'
       );
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.15",
+  "version": "1.0.0-alpha.17",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",
@@ -45,6 +45,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@lunora/errors": "1.0.0-alpha.1"
+  },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"
   }

package/dist/packem_shared/LunoraError-CL0aOtpo.mjs

@@ -1,46 +0,0 @@
-class LunoraError extends Error {
-  code;
-  status;
-  constructor(message, options) {
-    super(message, { cause: options?.cause });
-    this.name = "LunoraError";
-    this.code = options?.code ?? "INTERNAL";
-    this.status = options?.status ?? 500;
-  }
-  toResponse() {
-    const body = { error: { code: this.code, message: this.message } };
-    return Response.json(body, {
-      headers: { "content-type": "application/json" },
-      status: this.status
-    });
-  }
-}
-const hasErrorShape = (error, name) => {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const candidate = error;
-  return candidate.name === name && typeof candidate.code === "string" && typeof candidate.status === "number" && typeof candidate.message === "string";
-};
-const isStructuralConflictError = (error) => hasErrorShape(error, "ConflictError");
-const isStructuralLunoraError = (error) => hasErrorShape(error, "LunoraError");
-const toErrorResponse = (error) => {
-  if (error instanceof LunoraError) {
-    return error.toResponse();
-  }
-  if (isStructuralLunoraError(error) || isStructuralConflictError(error)) {
-    const body2 = { error: { code: error.code, message: error.message } };
-    return Response.json(body2, {
-      headers: { "content-type": "application/json" },
-      status: error.status
-    });
-  }
-  console.error("[lunora] unhandled error:", error);
-  const body = { error: { code: "INTERNAL", message: "Internal error" } };
-  return Response.json(body, {
-    headers: { "content-type": "application/json" },
-    status: 500
-  });
-};
-
-export { LunoraError, isStructuralConflictError, isStructuralLunoraError, toErrorResponse };