@lunora/runtime 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/index.d.mts

@@ -1643,6 +1643,19 @@ interface FunctionRegistryEntry {
   */
   kind: "action" | "mutation" | "query" | "stream";
   visibility?: "internal" | "public";
+  /**
+  * x402 payment tag set by the `.x402({ price })` builder modifier. Present
+  * only on paid public procedures; the origin worker answers an unpaid RPC
+  * for such a function with a real `402` challenge (via the injected
+  * {@link WorkerOptions.x402Charge} gate) before dispatching, then verifies +
+  * settles at the origin boundary so the shard never sees payment state.
+  * Rides along on the registered function object's identity — codegen casts
+  * the real `fn` into `LUNORA_FUNCTIONS`, so reading it needs no change to the
+  * generated shape (same as `fn.rls`).
+  */
+  x402?: {
+    readonly price: number | string;
+  };
 }
 /**
 * The generated `LUNORA_FUNCTIONS` dispatch table, narrowed to what the
@@ -1650,6 +1663,25 @@ interface FunctionRegistryEntry {
 */
 type FunctionRegistryLike = Record<string, FunctionRegistryEntry>;
 /**
+* Injected x402 charge gate — the seam that paywalls a `.x402({ price })`-tagged
+* procedure at the origin worker without the runtime importing `@lunora/x402`
+* (which would pull viem/solana into every worker bundle). Build it with
+* `createProcedureChargeGate(config)` from `@lunora/x402/charge` and pass it as
+* {@link WorkerOptions.x402Charge}.
+*
+* Given the inbound `request`, the paid procedure's `spec` (its `functionPath` —
+* used as the x402 challenge `resource` — and USD `price`), and a `dispatch`
+* that runs the real shard forward, it returns a real `402` + `PAYMENT-REQUIRED`
+* challenge when the request is unpaid, or the dispatched response (with
+* `X-PAYMENT-RESPONSE` attached) once the client's `X-PAYMENT` is verified and
+* settled. `dispatch` runs only after payment is verified — an unpaid or
+* invalid request never reaches the shard.
+*/
+type X402ChargeGate = (request: Request, spec: {
+  functionPath: string;
+  price: number | string;
+}, dispatch: () => Promise<Response>) => Promise<Response>;
+/**
 * Lists objects in the storage bucket for the admin file browser. Structurally
 * compatible with `@lunora/storage`'s `Storage["list"]` — the runtime stays free
 * of a hard dependency on the storage package.
@@ -2313,6 +2345,18 @@ interface WorkerOptions {
   * reports "not configured" and the studio shows the credentials empty state.
   */
   workflowsClient?: (env: unknown) => undefined | WorkflowsRestClient;
+  /**
+  * Injected x402 charge gate for paid (`.x402({ price })`) procedures. Build
+  * it with `createProcedureChargeGate(config)` from `@lunora/x402/charge` and
+  * pass it here; the runtime stays free of a hard `@lunora/x402` dependency
+  * (and its viem/solana deps).
+  *
+  * **Required whenever any registered function is `.x402()`-tagged.** The
+  * origin worker refuses to dispatch a paid procedure with a config error
+  * (`500`) when this is absent, rather than serving it free — the paywall is
+  * fail-closed by construction. See {@link X402ChargeGate}.
+  */
+  x402Charge?: X402ChargeGate;
 }
 interface RpcContext {
   ctx: ExecutionContextLike;

package/dist/index.d.ts

@@ -1643,6 +1643,19 @@ interface FunctionRegistryEntry {
   */
   kind: "action" | "mutation" | "query" | "stream";
   visibility?: "internal" | "public";
+  /**
+  * x402 payment tag set by the `.x402({ price })` builder modifier. Present
+  * only on paid public procedures; the origin worker answers an unpaid RPC
+  * for such a function with a real `402` challenge (via the injected
+  * {@link WorkerOptions.x402Charge} gate) before dispatching, then verifies +
+  * settles at the origin boundary so the shard never sees payment state.
+  * Rides along on the registered function object's identity — codegen casts
+  * the real `fn` into `LUNORA_FUNCTIONS`, so reading it needs no change to the
+  * generated shape (same as `fn.rls`).
+  */
+  x402?: {
+    readonly price: number | string;
+  };
 }
 /**
 * The generated `LUNORA_FUNCTIONS` dispatch table, narrowed to what the
@@ -1650,6 +1663,25 @@ interface FunctionRegistryEntry {
 */
 type FunctionRegistryLike = Record<string, FunctionRegistryEntry>;
 /**
+* Injected x402 charge gate — the seam that paywalls a `.x402({ price })`-tagged
+* procedure at the origin worker without the runtime importing `@lunora/x402`
+* (which would pull viem/solana into every worker bundle). Build it with
+* `createProcedureChargeGate(config)` from `@lunora/x402/charge` and pass it as
+* {@link WorkerOptions.x402Charge}.
+*
+* Given the inbound `request`, the paid procedure's `spec` (its `functionPath` —
+* used as the x402 challenge `resource` — and USD `price`), and a `dispatch`
+* that runs the real shard forward, it returns a real `402` + `PAYMENT-REQUIRED`
+* challenge when the request is unpaid, or the dispatched response (with
+* `X-PAYMENT-RESPONSE` attached) once the client's `X-PAYMENT` is verified and
+* settled. `dispatch` runs only after payment is verified — an unpaid or
+* invalid request never reaches the shard.
+*/
+type X402ChargeGate = (request: Request, spec: {
+  functionPath: string;
+  price: number | string;
+}, dispatch: () => Promise<Response>) => Promise<Response>;
+/**
 * Lists objects in the storage bucket for the admin file browser. Structurally
 * compatible with `@lunora/storage`'s `Storage["list"]` — the runtime stays free
 * of a hard dependency on the storage package.
@@ -2313,6 +2345,18 @@ interface WorkerOptions {
   * reports "not configured" and the studio shows the credentials empty state.
   */
   workflowsClient?: (env: unknown) => undefined | WorkflowsRestClient;
+  /**
+  * Injected x402 charge gate for paid (`.x402({ price })`) procedures. Build
+  * it with `createProcedureChargeGate(config)` from `@lunora/x402/charge` and
+  * pass it here; the runtime stays free of a hard `@lunora/x402` dependency
+  * (and its viem/solana deps).
+  *
+  * **Required whenever any registered function is `.x402()`-tagged.** The
+  * origin worker refuses to dispatch a paid procedure with a config error
+  * (`500`) when this is absent, rather than serving it free — the paywall is
+  * fail-closed by construction. See {@link X402ChargeGate}.
+  */
+  x402Charge?: X402ChargeGate;
 }
 interface RpcContext {
   ctx: ExecutionContextLike;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-Dpw9d1s5.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-CB3pLcCP.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';

package/dist/packem_shared/{composeWorker-Dpw9d1s5.mjs → composeWorker-CB3pLcCP.mjs}

@@ -2028,6 +2028,22 @@ const logRpcDebug = (env, envelope) => {
   }
   console.warn(`[lunora:rpc] ${envelope.fanOut ? "fan-out" : `shard=${envelope.shardKey ?? "(root)"}`} ${envelope.functionPath}`);
 };
+const resolveX402Charge = (envelope, options) => {
+  const x402Tag = options.functions?.[envelope.functionPath]?.x402;
+  if (!x402Tag) {
+    return void 0;
+  }
+  if (envelope.fanOut) {
+    throw new LunoraError("a paid (`.x402`) function cannot be fanned out", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (!options.x402Charge) {
+    throw new LunoraError(`function "${envelope.functionPath}" is marked paid (.x402) but no x402Charge gate is configured on the worker`, {
+      code: "MISCONFIGURED",
+      status: 500
+    });
+  }
+  return x402Tag;
+};
 const parseEnvelope = async (request) => {
   const text = await readBodyTextWithLimit(request);
   let body;
@@ -2621,6 +2637,7 @@ const createWorker = (options) => {
     }
     const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
+    const x402Tag = resolveX402Charge(envelope, options);
     {
       const rpcStartedAt = Date.now();
       const { observability } = options;
@@ -2672,7 +2689,11 @@ const createWorker = (options) => {
         }
       }
       const shardKey = envelope.shardKey ?? defaultShard;
-      return dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+      const dispatch = () => dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+      if (x402Tag && options.x402Charge) {
+        return options.x402Charge(request, { functionPath: envelope.functionPath, price: x402Tag.price }, dispatch);
+      }
+      return dispatch();
     }
   };
   const handleBatchRpc = async (request, env, context) => {
@@ -2695,6 +2716,19 @@ const createWorker = (options) => {
     }
     const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
     const groups = groupBatchCallsByShard(calls, defaultShard);
+    for (const entries of groups.values()) {
+      for (const entry of entries) {
+        if (options.functions?.[entry.functionPath]?.x402) {
+          throw new LunoraError(
+            `paid (\`.x402\`) function "${entry.functionPath}" cannot be called in a batch; dispatch it individually over ${RPC_PATH}`,
+            {
+              code: "BAD_REQUEST",
+              status: 400
+            }
+          );
+        }
+      }
+    }
     await Promise.all(
       [...groups.entries()].flatMap(
         ([shardKey, entries]) => entries.map((entry) => authorizeRpcEnvelope({ functionPath: entry.functionPath, shardKey }, identity))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.21",
+  "version": "1.0.0-alpha.23",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.2"
+    "@lunora/errors": "1.0.0-alpha.3"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"