@lunora/runtime 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/packem_shared/{createCrossShardRelationCapabilities-C0KOf7er.mjs → createCrossShardRelationCapabilities-CbcWjkAn.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
+
 const RPC_ENDPOINT = "/_lunora/rpc";
 const buildIdentityHeaders = (options) => {
   const headers = { "content-type": "application/json" };
@@ -19,12 +21,12 @@ const fanOutRelation = async (options, body, label) => {
     })
   );
   if (!response.ok) {
-    throw new Error(`cross-shard relation ${label} failed: worker returned ${String(response.status)}`);
+    throw new LunoraError(`cross-shard relation ${label} failed: worker returned ${String(response.status)}`);
   }
   const result = await response.json();
   if (typeof result.failed === "number" && result.failed > 0) {
     const reached = (typeof result.ok === "number" ? result.ok : 0) + result.failed;
-    throw new Error(
+    throw new LunoraError(
       `cross-shard relation ${label} failed on ${String(result.failed)} of ${String(reached)} shard(s) — refusing to return a partial result`
     );
   }

package/dist/packem_shared/{createQueryCoordinator-DbxC7iUz.mjs → createQueryCoordinator-DNCJzOZE.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-CL0aOtpo.mjs';
-import { resolveShard } from './resolveShard-DDkzWtrU.mjs';
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
+import { resolveShard } from './applyJurisdiction-BkZtTkct.mjs';
 
 const createStaticShardRegistry = (table_to_keys) => {
   return {
@@ -547,7 +547,16 @@ const mergeTopK = (values, strategy) => {
     }
   }
   const direction = strategy.direction ?? "desc";
-  collected.sort((a, b) => direction === "asc" ? a.score - b.score : b.score - a.score);
+  const ascending = (x, y) => {
+    if (x < y) {
+      return -1;
+    }
+    if (x > y) {
+      return 1;
+    }
+    return 0;
+  };
+  collected.sort((a, b) => direction === "asc" ? ascending(a.score, b.score) : ascending(b.score, a.score));
   return collected.slice(0, strategy.k).map((entry) => entry.row);
 };
 const mergeShardResults = (values, strategy) => {

package/dist/packem_shared/{decorateResponse-DbISh_Wi.mjs → decorateResponse-CsZc49QC.mjs}

@@ -1,4 +1,15 @@
+import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
+
 const DEFAULT_CSP = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+const htmlCspFor = (frameOptions) => {
+  const parts = ["base-uri 'none'", "object-src 'none'"];
+  if (frameOptions === "DENY") {
+    parts.push("frame-ancestors 'none'");
+  } else if (frameOptions === "SAMEORIGIN") {
+    parts.push("frame-ancestors 'self'");
+  }
+  return parts.join("; ");
+};
 const DEFAULT_PERMISSIONS_POLICY = "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
 const DEFAULT_CORS_HEADERS = ["Authorization", "Content-Type", "X-D1-Bookmark", "X-Lunora-Mutation-Id"];
 const DEFAULT_CORS_METHODS = ["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"];
@@ -13,14 +24,14 @@ const resolveHstsHeader = (hsts) => {
   const includeSubDomains = config.includeSubDomains ?? true;
   return `max-age=${String(maxAge)}${includeSubDomains ? "; includeSubDomains" : ""}${config.preload ? "; preload" : ""}`;
 };
-const resolveCspHeader = (csp) => {
+const resolveCspHeader = (csp, htmlDefault) => {
   if (csp === false) {
     return void 0;
   }
   if (typeof csp === "string") {
-    return { htmlToo: true, value: csp };
+    return { htmlValue: csp, value: csp };
   }
-  return { htmlToo: false, value: DEFAULT_CSP };
+  return { htmlValue: htmlDefault, value: DEFAULT_CSP };
 };
 const resolveHeaders = (input) => {
   if (input === false) {
@@ -35,11 +46,12 @@ const resolveHeaders = (input) => {
     };
   }
   const options = input === void 0 || input === true ? {} : input;
+  const frameOptions = options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN";
   return {
     coop: "same-origin",
-    csp: resolveCspHeader(options.csp),
+    csp: resolveCspHeader(options.csp, htmlCspFor(frameOptions)),
     enabled: true,
-    frameOptions: options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN",
+    frameOptions,
     hsts: resolveHstsHeader(options.hsts),
     permissionsPolicy: options.permissionsPolicy === false ? void 0 : options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY,
     referrerPolicy: options.referrerPolicy === false ? void 0 : options.referrerPolicy ?? "strict-origin-when-cross-origin"
@@ -65,10 +77,14 @@ const resolveCors = (input) => {
   if (typeof origins === "function") {
     isAllowed = origins;
     isExplicitlyAllowed = origins;
+    const credentialsNote = allowCredentials ? " AND reflects matching origins with credentials (`allowCredentials: true`)" : "";
+    console.warn(
+      `@lunora/runtime: security.cors uses a custom \`allowedOrigins\` predicate. It is trusted by the CSRF and WebSocket origin checks${credentialsNote} — ensure it matches ONLY trusted origins by exact equality; an over-broad predicate (e.g. \`() => true\`, or \`endsWith\`/\`includes\` checks) defeats the allowlist.`
+    );
   } else {
     const originsList = origins;
     if (originsList.includes("*") && allowCredentials) {
-      throw new Error(
+      throw new LunoraError(
         '@lunora/runtime: security.cors cannot combine a wildcard origin ("*") with allowCredentials: true — browsers reject it and it defeats the allowlist.'
       );
     }
@@ -152,6 +168,20 @@ const enforceOrigin = (request, resolved) => {
     { headers: { "content-type": "application/json" }, status: 403 }
   );
 };
+const enforceWebSocketOrigin = (request, resolved) => {
+  if (!resolved.csrf.enabled || !request.headers.get("cookie")) {
+    return void 0;
+  }
+  const selfOrigin = new URL(request.url).origin;
+  const source = originOf(request.headers.get("origin"));
+  if (source !== void 0 && isTrustedOrigin(source, selfOrigin, resolved)) {
+    return void 0;
+  }
+  return Response.json(
+    { error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin websocket upgrade rejected" } },
+    { headers: { "content-type": "application/json" }, status: 403 }
+  );
+};
 const corsResponseHeaders = (origin, cors) => {
   const headers = new Headers();
   headers.set("access-control-allow-origin", origin);
@@ -199,8 +229,11 @@ const applyBaselineHeaders = (headers, request, response, config) => {
   if (config.coop !== void 0) {
     setIfAbsent(headers, "cross-origin-opener-policy", config.coop);
   }
-  if (config.csp !== void 0 && (config.csp.htmlToo || !isHtmlResponse(response))) {
-    setIfAbsent(headers, "content-security-policy", config.csp.value);
+  if (config.csp !== void 0) {
+    const cspValue = isHtmlResponse(response) ? config.csp.htmlValue : config.csp.value;
+    if (cspValue !== void 0) {
+      setIfAbsent(headers, "content-security-policy", cspValue);
+    }
   }
 };
 const applyCorsHeaders = (headers, request, cors) => {
@@ -230,4 +263,4 @@ const decorateResponse = (response, request, resolved) => {
   return new Response(response.body, { headers, status: response.status, statusText: response.statusText });
 };
 
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity };
+export { decorateResponse, enforceOrigin, enforceWebSocketOrigin, handleCorsPreflight, resolveSecurity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",
@@ -25,7 +25,7 @@
     "directory": "packages/runtime"
   },
   "files": [
-    "dist",
+    "./dist",
     "README.md",
     "LICENSE.md",
     "__assets__"
@@ -45,6 +45,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@lunora/errors": "1.0.0-alpha.2"
+  },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"
   }

package/dist/packem_shared/LunoraError-CL0aOtpo.mjs

@@ -1,46 +0,0 @@
-class LunoraError extends Error {
-  code;
-  status;
-  constructor(message, options) {
-    super(message, { cause: options?.cause });
-    this.name = "LunoraError";
-    this.code = options?.code ?? "INTERNAL";
-    this.status = options?.status ?? 500;
-  }
-  toResponse() {
-    const body = { error: { code: this.code, message: this.message } };
-    return Response.json(body, {
-      headers: { "content-type": "application/json" },
-      status: this.status
-    });
-  }
-}
-const hasErrorShape = (error, name) => {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const candidate = error;
-  return candidate.name === name && typeof candidate.code === "string" && typeof candidate.status === "number" && typeof candidate.message === "string";
-};
-const isStructuralConflictError = (error) => hasErrorShape(error, "ConflictError");
-const isStructuralLunoraError = (error) => hasErrorShape(error, "LunoraError");
-const toErrorResponse = (error) => {
-  if (error instanceof LunoraError) {
-    return error.toResponse();
-  }
-  if (isStructuralLunoraError(error) || isStructuralConflictError(error)) {
-    const body2 = { error: { code: error.code, message: error.message } };
-    return Response.json(body2, {
-      headers: { "content-type": "application/json" },
-      status: error.status
-    });
-  }
-  console.error("[lunora] unhandled error:", error);
-  const body = { error: { code: "INTERNAL", message: "Internal error" } };
-  return Response.json(body, {
-    headers: { "content-type": "application/json" },
-    status: 500
-  });
-};
-
-export { LunoraError, isStructuralConflictError, isStructuralLunoraError, toErrorResponse };

package/dist/packem_shared/resolveShard-DDkzWtrU.mjs

@@ -1,9 +0,0 @@
-const resolveShard = (namespace, shardKey) => {
-  if (typeof namespace.getByName === "function") {
-    return namespace.getByName(shardKey);
-  }
-  const id = namespace.idFromName(shardKey);
-  return namespace.get(id);
-};
-
-export { resolveShard };