@lunora/runtime 1.0.0-alpha.18 → 1.0.0-alpha.19

package/LICENSE.md

@@ -103,3 +103,9 @@ Unless required by applicable law or agreed to in writing, software distributed
 under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 CONDITIONS OF ANY KIND, either express or implied. See the License for the
 specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+<!-- /TYPE_DEPENDENCIES -->

package/dist/index.d.mts

@@ -197,6 +197,43 @@ interface AuthCapabilities {
   passkey: boolean;
   twoFactor: boolean;
 }
+/** One user-settable extra field for the create-user form, derived from the merged `user` table. */
+interface AuthUserFieldSpec {
+  name: string;
+  plugin?: string;
+  required: boolean;
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* Rich, read-only description of the deployment's auth configuration — enabled
+* plugins, sign-in methods, user-settable fields, organization sub-features, and
+* session / rate-limit policy — for the studio's config panel and dynamic
+* create-user form. Never carries a secret.
+*/
+interface AuthConfigInfo {
+  capabilities: AuthCapabilities;
+  emailAndPassword: boolean;
+  organization: {
+    enabled: boolean;
+    roles: boolean;
+    teams: boolean;
+  };
+  plugins: string[];
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  socialProviders: string[];
+  userFields: AuthUserFieldSpec[];
+}
 /** Filtering / paging options forwarded to {@link AuthAdmin.listUsers} from the users endpoint's query string. */
 interface ListAuthUsersOptions {
   filterField?: string;
@@ -221,6 +258,15 @@ interface ListAuthUsersOptions {
 * implementation is a trusted server-side operator, not an end-user API.
 */
 interface AuthAdmin {
+  addMember?: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<Record<string, unknown>>;
+  addTeamMember?: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<Record<string, unknown>>;
   banUser?: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -230,6 +276,23 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities?: () => Promise<AuthCapabilities>;
+  config?: () => Promise<AuthConfigInfo>;
+  createOrganization?: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<Record<string, unknown>>;
+  createOrgRole?: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<Record<string, unknown>>;
+  createTeam?: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<Record<string, unknown>>;
   createUser?: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -237,6 +300,12 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthUser>;
+  deleteOrganization?: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  deleteOrgRole?: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey?: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -246,6 +315,12 @@ interface AuthAdmin {
   impersonateUser?: (input: {
     userId: string;
   }) => Promise<AuthImpersonation>;
+  inviteMember?: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<Record<string, unknown>>;
   listAccounts?: (input: {
     userId: string;
   }) => Promise<Record<string, unknown>[]>;
@@ -263,6 +338,11 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<Record<string, unknown>>>;
+  listOrgRoles?: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
   listPasskeys?: (input: {
     userId: string;
   }) => Promise<Record<string, unknown>[]>;
@@ -271,10 +351,26 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthSession>>;
+  listTeamMembers?: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
+  listTeams?: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
   listUsers: (options: ListAuthUsersOptions) => Promise<AuthPage<AuthUser>>;
   removeMember?: (input: {
     memberId: string;
   }) => Promise<void>;
+  removeTeam?: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  removeTeamMember?: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser?: (input: {
     userId: string;
   }) => Promise<void>;
@@ -299,6 +395,25 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  updateMemberRole?: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<Record<string, unknown>>;
+  updateOrganization?: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<Record<string, unknown>>;
+  updateOrgRole?: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<Record<string, unknown>>;
+  updateTeam?: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<Record<string, unknown>>;
   updateUser?: (input: {
     data: Record<string, unknown>;
     userId: string;
@@ -2610,4 +2725,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -197,6 +197,43 @@ interface AuthCapabilities {
   passkey: boolean;
   twoFactor: boolean;
 }
+/** One user-settable extra field for the create-user form, derived from the merged `user` table. */
+interface AuthUserFieldSpec {
+  name: string;
+  plugin?: string;
+  required: boolean;
+  type: "boolean" | "date" | "number" | "string";
+  unique: boolean;
+}
+/**
+* Rich, read-only description of the deployment's auth configuration — enabled
+* plugins, sign-in methods, user-settable fields, organization sub-features, and
+* session / rate-limit policy — for the studio's config panel and dynamic
+* create-user form. Never carries a secret.
+*/
+interface AuthConfigInfo {
+  capabilities: AuthCapabilities;
+  emailAndPassword: boolean;
+  organization: {
+    enabled: boolean;
+    roles: boolean;
+    teams: boolean;
+  };
+  plugins: string[];
+  rateLimit: {
+    enabled: boolean;
+    max?: number;
+    window?: number;
+  };
+  session: {
+    cookieCache?: boolean;
+    expiresIn?: number;
+    freshAge?: number;
+    updateAge?: number;
+  };
+  socialProviders: string[];
+  userFields: AuthUserFieldSpec[];
+}
 /** Filtering / paging options forwarded to {@link AuthAdmin.listUsers} from the users endpoint's query string. */
 interface ListAuthUsersOptions {
   filterField?: string;
@@ -221,6 +258,15 @@ interface ListAuthUsersOptions {
 * implementation is a trusted server-side operator, not an end-user API.
 */
 interface AuthAdmin {
+  addMember?: (input: {
+    organizationId: string;
+    role?: string;
+    userId: string;
+  }) => Promise<Record<string, unknown>>;
+  addTeamMember?: (input: {
+    teamId: string;
+    userId: string;
+  }) => Promise<Record<string, unknown>>;
   banUser?: (input: {
     expiresInSeconds?: number;
     reason?: string;
@@ -230,6 +276,23 @@ interface AuthAdmin {
     invitationId: string;
   }) => Promise<void>;
   capabilities?: () => Promise<AuthCapabilities>;
+  config?: () => Promise<AuthConfigInfo>;
+  createOrganization?: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name: string;
+    ownerId?: string;
+    slug?: string;
+  }) => Promise<Record<string, unknown>>;
+  createOrgRole?: (input: {
+    organizationId: string;
+    permission: Record<string, string[]>;
+    role: string;
+  }) => Promise<Record<string, unknown>>;
+  createTeam?: (input: {
+    name: string;
+    organizationId: string;
+  }) => Promise<Record<string, unknown>>;
   createUser?: (input: {
     data?: Record<string, unknown>;
     email: string;
@@ -237,6 +300,12 @@ interface AuthAdmin {
     password?: string;
     role?: string | string[];
   }) => Promise<AuthUser>;
+  deleteOrganization?: (input: {
+    organizationId: string;
+  }) => Promise<void>;
+  deleteOrgRole?: (input: {
+    roleId: string;
+  }) => Promise<void>;
   deletePasskey?: (input: {
     passkeyId: string;
   }) => Promise<void>;
@@ -246,6 +315,12 @@ interface AuthAdmin {
   impersonateUser?: (input: {
     userId: string;
   }) => Promise<AuthImpersonation>;
+  inviteMember?: (input: {
+    email: string;
+    inviterId?: string;
+    organizationId: string;
+    role?: string;
+  }) => Promise<Record<string, unknown>>;
   listAccounts?: (input: {
     userId: string;
   }) => Promise<Record<string, unknown>[]>;
@@ -263,6 +338,11 @@ interface AuthAdmin {
     limit?: number;
     offset?: number;
   }) => Promise<AuthPage<Record<string, unknown>>>;
+  listOrgRoles?: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
   listPasskeys?: (input: {
     userId: string;
   }) => Promise<Record<string, unknown>[]>;
@@ -271,10 +351,26 @@ interface AuthAdmin {
     offset?: number;
     userId?: string;
   }) => Promise<AuthPage<AuthSession>>;
+  listTeamMembers?: (options: {
+    limit?: number;
+    offset?: number;
+    teamId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
+  listTeams?: (options: {
+    limit?: number;
+    offset?: number;
+    organizationId: string;
+  }) => Promise<AuthPage<Record<string, unknown>>>;
   listUsers: (options: ListAuthUsersOptions) => Promise<AuthPage<AuthUser>>;
   removeMember?: (input: {
     memberId: string;
   }) => Promise<void>;
+  removeTeam?: (input: {
+    teamId: string;
+  }) => Promise<void>;
+  removeTeamMember?: (input: {
+    teamMemberId: string;
+  }) => Promise<void>;
   removeUser?: (input: {
     userId: string;
   }) => Promise<void>;
@@ -299,6 +395,25 @@ interface AuthAdmin {
     accountId: string;
     userId: string;
   }) => Promise<void>;
+  updateMemberRole?: (input: {
+    memberId: string;
+    role: string | string[];
+  }) => Promise<Record<string, unknown>>;
+  updateOrganization?: (input: {
+    logo?: string;
+    metadata?: Record<string, unknown>;
+    name?: string;
+    organizationId: string;
+    slug?: string;
+  }) => Promise<Record<string, unknown>>;
+  updateOrgRole?: (input: {
+    permission: Record<string, string[]>;
+    roleId: string;
+  }) => Promise<Record<string, unknown>>;
+  updateTeam?: (input: {
+    name: string;
+    teamId: string;
+  }) => Promise<Record<string, unknown>>;
   updateUser?: (input: {
     data: Record<string, unknown>;
     userId: string;
@@ -2610,4 +2725,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-CR1Z2s7k.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-B8fPlc94.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';

package/dist/packem_shared/{composeWorker-CR1Z2s7k.mjs → composeWorker-B8fPlc94.mjs}

@@ -12,6 +12,9 @@ const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(i
 
 const AUTH_BASE = "/_lunora/admin/auth";
 const AUTH_ADMIN_ERROR_STATUS = {
+  INVITER_REQUIRED: 400,
+  ORG_SLUG_INVALID: 400,
+  ORG_SLUG_TAKEN: 409,
   PASSWORD_TOO_LONG: 400,
   PASSWORD_TOO_SHORT: 400,
   USER_ALREADY_EXISTS: 409,
@@ -41,6 +44,23 @@ const parseRoleInput = (value) => {
   return void 0;
 };
 const optionalBodyString = (body, field) => typeof body[field] === "string" ? body[field] : void 0;
+const optionalBodyObject = (body, field) => {
+  const value = body[field];
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+};
+const requirePermission = (body) => {
+  const value = body["permission"];
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new LunoraError("`permission` object is required", { code: "BAD_REQUEST", status: 400 });
+  }
+  const out = {};
+  for (const [resource, actions] of Object.entries(value)) {
+    if (Array.isArray(actions) && actions.every((action) => typeof action === "string")) {
+      out[resource] = actions;
+    }
+  }
+  return out;
+};
 const AUTH_ROUTES = {
   [`${AUTH_BASE}/capabilities`]: {
     build: () => {
@@ -107,6 +127,34 @@ const AUTH_ROUTES = {
     http: "GET",
     method: "listInvitations"
   },
+  [`${AUTH_BASE}/config`]: {
+    build: () => {
+      return {};
+    },
+    http: "GET",
+    method: "config"
+  },
+  [`${AUTH_BASE}/organizations/teams`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listTeams"
+  },
+  [`${AUTH_BASE}/organizations/teams/members`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, teamId: requireQuery$1(query, "teamId") };
+    },
+    http: "GET",
+    method: "listTeamMembers"
+  },
+  [`${AUTH_BASE}/organizations/roles`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listOrgRoles"
+  },
   // --- mutations (POST) -------------------------------------------------------
   [`${AUTH_BASE}/users/create`]: {
     build: ({ body }) => {
@@ -239,6 +287,137 @@ const AUTH_ROUTES = {
     http: "POST",
     method: "cancelInvitation",
     returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/create`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: requireBodyString(body, "name"),
+        ownerId: optionalBodyString(body, "ownerId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "createOrganization"
+  },
+  [`${AUTH_BASE}/organizations/update`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: optionalBodyString(body, "name"),
+        organizationId: requireBodyString(body, "organizationId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "updateOrganization"
+  },
+  [`${AUTH_BASE}/organizations/remove`]: {
+    build: ({ body }) => {
+      return { organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "deleteOrganization",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/members/add`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role"),
+        userId: requireBodyString(body, "userId")
+      };
+    },
+    http: "POST",
+    method: "addMember"
+  },
+  [`${AUTH_BASE}/organizations/members/invite`]: {
+    build: ({ body }) => {
+      return {
+        email: requireBodyString(body, "email"),
+        inviterId: optionalBodyString(body, "inviterId"),
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "inviteMember"
+  },
+  [`${AUTH_BASE}/organizations/members/role`]: {
+    build: ({ body }) => {
+      const role = parseRoleInput(body["role"]);
+      if (role === void 0 || typeof role === "string" && role.trim() === "") {
+        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
+      }
+      return { memberId: requireBodyString(body, "memberId"), role };
+    },
+    http: "POST",
+    method: "updateMemberRole"
+  },
+  [`${AUTH_BASE}/organizations/teams/create`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "createTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/update`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "updateTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/remove`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "removeTeam",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/add`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId"), userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "addTeamMember"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/remove`]: {
+    build: ({ body }) => {
+      return { teamMemberId: requireBodyString(body, "teamMemberId") };
+    },
+    http: "POST",
+    method: "removeTeamMember",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/roles/create`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        permission: requirePermission(body),
+        role: requireBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "createOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/update`]: {
+    build: ({ body }) => {
+      return { permission: requirePermission(body), roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "updateOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/remove`]: {
+    build: ({ body }) => {
+      return { roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "deleteOrgRole",
+    returns: "void"
   }
 };
 const buildAuthAdminRoutes = (deps) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.18",
+  "version": "1.0.0-alpha.19",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",