@lunora/runtime 1.0.0-alpha.26 → 1.0.0-alpha.260

package/dist/packem_shared/decorateResponse-DRWQFNhF.mjs

@@ -1,273 +0,0 @@
-import { LunoraError } from './LunoraError-Bpb9EFJ3.mjs';
-
-const DEFAULT_CSP = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
-const htmlCspFor = (frameOptions) => {
-  const parts = ["base-uri 'none'", "object-src 'none'"];
-  if (frameOptions === "DENY") {
-    parts.push("frame-ancestors 'none'");
-  } else if (frameOptions === "SAMEORIGIN") {
-    parts.push("frame-ancestors 'self'");
-  }
-  return parts.join("; ");
-};
-const DEFAULT_PERMISSIONS_POLICY = "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
-const DEFAULT_CORS_HEADERS = ["Authorization", "Content-Type", "X-D1-Bookmark", "X-Lunora-Mutation-Id"];
-const DEFAULT_CORS_METHODS = ["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"];
-const ONE_YEAR_SECONDS = 31536e3;
-const SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-const resolveHstsHeader = (hsts) => {
-  if (hsts === false) {
-    return void 0;
-  }
-  const config = hsts === void 0 || hsts === true ? {} : hsts;
-  const maxAge = config.maxAge ?? ONE_YEAR_SECONDS;
-  const includeSubDomains = config.includeSubDomains ?? true;
-  return `max-age=${String(maxAge)}${includeSubDomains ? "; includeSubDomains" : ""}${config.preload ? "; preload" : ""}`;
-};
-const resolveCspHeader = (csp, htmlDefault) => {
-  if (csp === false) {
-    return void 0;
-  }
-  if (typeof csp === "string") {
-    return { htmlValue: csp, value: csp };
-  }
-  return { htmlValue: htmlDefault, value: DEFAULT_CSP };
-};
-const resolveHeaders = (input) => {
-  if (input === false) {
-    return {
-      coop: void 0,
-      csp: void 0,
-      enabled: false,
-      frameOptions: void 0,
-      hsts: void 0,
-      permissionsPolicy: void 0,
-      referrerPolicy: void 0
-    };
-  }
-  const options = input === void 0 || input === true ? {} : input;
-  const frameOptions = options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN";
-  return {
-    coop: "same-origin",
-    csp: resolveCspHeader(options.csp, htmlCspFor(frameOptions)),
-    enabled: true,
-    frameOptions,
-    hsts: resolveHstsHeader(options.hsts),
-    permissionsPolicy: options.permissionsPolicy === false ? void 0 : options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY,
-    referrerPolicy: options.referrerPolicy === false ? void 0 : options.referrerPolicy ?? "strict-origin-when-cross-origin"
-  };
-};
-const resolveCors = (input) => {
-  const disabled = {
-    allowCredentials: false,
-    allowedHeaders: DEFAULT_CORS_HEADERS,
-    allowedMethods: DEFAULT_CORS_METHODS,
-    enabled: false,
-    isAllowed: () => false,
-    isExplicitlyAllowed: () => false,
-    maxAge: 600
-  };
-  if (input === void 0 || input === false) {
-    return disabled;
-  }
-  const allowCredentials = input.allowCredentials ?? false;
-  const origins = input.allowedOrigins;
-  let isAllowed;
-  let isExplicitlyAllowed;
-  if (typeof origins === "function") {
-    isAllowed = origins;
-    isExplicitlyAllowed = origins;
-    const credentialsNote = allowCredentials ? " AND reflects matching origins with credentials (`allowCredentials: true`)" : "";
-    console.warn(
-      `@lunora/runtime: security.cors uses a custom \`allowedOrigins\` predicate. It is trusted by the CSRF and WebSocket origin checks${credentialsNote} — ensure it matches ONLY trusted origins by exact equality; an over-broad predicate (e.g. \`() => true\`, or \`endsWith\`/\`includes\` checks) defeats the allowlist.`
-    );
-  } else {
-    const originsList = origins;
-    if (originsList.includes("*") && allowCredentials) {
-      throw new LunoraError(
-        '@lunora/runtime: security.cors cannot combine a wildcard origin ("*") with allowCredentials: true — browsers reject it and it defeats the allowlist.'
-      );
-    }
-    isAllowed = (origin) => originsList.includes("*") || originsList.includes(origin);
-    isExplicitlyAllowed = (origin) => originsList.includes(origin);
-  }
-  return {
-    allowCredentials,
-    allowedHeaders: input.allowedHeaders ?? DEFAULT_CORS_HEADERS,
-    allowedMethods: input.allowedMethods ?? DEFAULT_CORS_METHODS,
-    enabled: true,
-    isAllowed,
-    isExplicitlyAllowed,
-    maxAge: input.maxAge ?? 600
-  };
-};
-const resolveCsrf = (input) => {
-  if (input === false) {
-    return { enabled: false, trustedOrigins: [] };
-  }
-  const options = input === void 0 || input === true ? {} : input;
-  return { enabled: true, trustedOrigins: options.trustedOrigins ?? [] };
-};
-const DISABLED_ENV_VALUES = /* @__PURE__ */ new Set(["0", "disabled", "false", "no", "off"]);
-const ENABLED_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
-const isEnvDisabled = (value) => typeof value === "string" && DISABLED_ENV_VALUES.has(value.trim().toLowerCase());
-const isEnvEnabled = (value) => typeof value === "string" && ENABLED_ENV_VALUES.has(value.trim().toLowerCase());
-const parseEnvCors = (env) => {
-  const raw = env?.["LUNORA_ALLOWED_ORIGINS"];
-  if (typeof raw !== "string") {
-    return void 0;
-  }
-  const allowedOrigins = raw.split(",").map((origin) => origin.trim()).filter((origin) => origin.length > 0);
-  if (allowedOrigins.length === 0) {
-    return void 0;
-  }
-  const wildcard = allowedOrigins.includes("*");
-  const allowCredentials = !wildcard && isEnvEnabled(env?.["LUNORA_CORS_ALLOW_CREDENTIALS"]);
-  return { allowCredentials, allowedOrigins };
-};
-const resolveSecurity = (security, env) => {
-  const headers = security?.headers ?? (isEnvDisabled(env?.["LUNORA_SECURITY_HEADERS"]) ? false : void 0);
-  const csrf = security?.csrf ?? (isEnvDisabled(env?.["LUNORA_SECURITY_CSRF"]) ? false : void 0);
-  const cors = security?.cors ?? parseEnvCors(env);
-  return {
-    cors: resolveCors(cors),
-    csrf: resolveCsrf(csrf),
-    headers: resolveHeaders(headers)
-  };
-};
-const originOf = (value) => {
-  if (!value) {
-    return void 0;
-  }
-  try {
-    return new URL(value).origin;
-  } catch {
-    return void 0;
-  }
-};
-const isTrustedOrigin = (origin, selfOrigin, resolved) => {
-  if (origin === selfOrigin) {
-    return true;
-  }
-  if (resolved.csrf.trustedOrigins.includes(origin)) {
-    return true;
-  }
-  return resolved.cors.enabled && resolved.cors.isExplicitlyAllowed(origin);
-};
-const enforceOrigin = (request, resolved) => {
-  if (!resolved.csrf.enabled || SAFE_METHODS.has(request.method) || !request.headers.get("cookie")) {
-    return void 0;
-  }
-  const selfOrigin = new URL(request.url).origin;
-  const source = originOf(request.headers.get("origin")) ?? originOf(request.headers.get("referer"));
-  if (source !== void 0 && isTrustedOrigin(source, selfOrigin, resolved)) {
-    return void 0;
-  }
-  return Response.json(
-    { error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin state-changing request rejected" } },
-    { headers: { "content-type": "application/json" }, status: 403 }
-  );
-};
-const enforceWebSocketOrigin = (request, resolved) => {
-  if (!resolved.csrf.enabled || !request.headers.get("cookie")) {
-    return void 0;
-  }
-  const selfOrigin = new URL(request.url).origin;
-  const source = originOf(request.headers.get("origin"));
-  if (source !== void 0 && isTrustedOrigin(source, selfOrigin, resolved)) {
-    return void 0;
-  }
-  return Response.json(
-    { error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin websocket upgrade rejected" } },
-    { headers: { "content-type": "application/json" }, status: 403 }
-  );
-};
-const corsResponseHeaders = (origin, cors) => {
-  const headers = new Headers();
-  headers.set("access-control-allow-origin", origin);
-  headers.append("vary", "Origin");
-  if (cors.allowCredentials) {
-    headers.set("access-control-allow-credentials", "true");
-  }
-  return headers;
-};
-const handleCorsPreflight = (request, resolved) => {
-  if (!resolved.cors.enabled || request.method !== "OPTIONS") {
-    return void 0;
-  }
-  const origin = request.headers.get("origin");
-  if (!origin || !request.headers.get("access-control-request-method") || !resolved.cors.isAllowed(origin)) {
-    return void 0;
-  }
-  const headers = corsResponseHeaders(origin, resolved.cors);
-  const requested = request.headers.get("access-control-request-headers");
-  headers.set("access-control-allow-methods", resolved.cors.allowedMethods.join(", "));
-  let allowedHeaders;
-  if (requested === null) {
-    allowedHeaders = resolved.cors.allowedHeaders.join(", ");
-  } else {
-    const permitted = new Set(resolved.cors.allowedHeaders.map((name) => name.toLowerCase()));
-    allowedHeaders = requested.split(",").map((name) => name.trim()).filter((name) => name.length > 0 && permitted.has(name.toLowerCase())).join(", ");
-  }
-  headers.set("access-control-allow-headers", allowedHeaders);
-  headers.set("access-control-max-age", String(resolved.cors.maxAge));
-  return new Response(null, { headers, status: 204 });
-};
-const isHtmlResponse = (response) => (response.headers.get("content-type") ?? "").toLowerCase().includes("text/html");
-const setIfAbsent = (headers, name, value) => {
-  if (!headers.has(name)) {
-    headers.set(name, value);
-  }
-};
-const applyBaselineHeaders = (headers, request, response, config) => {
-  if (config.hsts !== void 0 && new URL(request.url).protocol === "https:") {
-    setIfAbsent(headers, "strict-transport-security", config.hsts);
-  }
-  setIfAbsent(headers, "x-content-type-options", "nosniff");
-  if (config.frameOptions !== void 0) {
-    setIfAbsent(headers, "x-frame-options", config.frameOptions);
-  }
-  if (config.referrerPolicy !== void 0) {
-    setIfAbsent(headers, "referrer-policy", config.referrerPolicy);
-  }
-  if (config.permissionsPolicy !== void 0) {
-    setIfAbsent(headers, "permissions-policy", config.permissionsPolicy);
-  }
-  if (config.coop !== void 0) {
-    setIfAbsent(headers, "cross-origin-opener-policy", config.coop);
-  }
-  if (config.csp !== void 0) {
-    const cspValue = isHtmlResponse(response) ? config.csp.htmlValue : config.csp.value;
-    if (cspValue !== void 0) {
-      setIfAbsent(headers, "content-security-policy", cspValue);
-    }
-  }
-};
-const applyCorsHeaders = (headers, request, cors) => {
-  const origin = request.headers.get("origin");
-  if (!origin || !cors.isAllowed(origin)) {
-    return;
-  }
-  for (const [name, value] of corsResponseHeaders(origin, cors).entries()) {
-    if (name === "vary") {
-      headers.append("vary", value);
-    } else {
-      setIfAbsent(headers, name, value);
-    }
-  }
-};
-const decorateResponse = (response, request, resolved) => {
-  if (response.status === 101 || response.webSocket) {
-    return response;
-  }
-  const headers = new Headers(response.headers);
-  if (resolved.headers.enabled) {
-    applyBaselineHeaders(headers, request, response, resolved.headers);
-  }
-  if (resolved.cors.enabled) {
-    applyCorsHeaders(headers, request, resolved.cors);
-  }
-  return new Response(response.body, { headers, status: response.status, statusText: response.statusText });
-};
-
-export { decorateResponse, enforceOrigin, enforceWebSocketOrigin, handleCorsPreflight, resolveSecurity };

package/dist/packem_shared/emitLogEvent-pEdtqAK8.mjs

@@ -1,20 +0,0 @@
-const emitRpcEvent = (sink, event, context) => {
-  if (!sink?.onRpc) {
-    return;
-  }
-  try {
-    sink.onRpc(event, context);
-  } catch {
-  }
-};
-const emitLogEvent = (sink, event, context) => {
-  if (!sink?.onLog) {
-    return;
-  }
-  try {
-    sink.onLog(event, context);
-  } catch {
-  }
-};
-
-export { emitLogEvent, emitRpcEvent };

package/dist/packem_shared/otlp-D_YzGXu1.mjs

@@ -1,81 +0,0 @@
-const OTLP_SEVERITY = {
-  debug: 5,
-  // DEBUG
-  error: 17,
-  // ERROR
-  info: 9,
-  // INFO
-  log: 9,
-  // INFO
-  warn: 13
-  // WARN
-};
-const otlpUnixNano = (ms) => `${String(Math.round(ms))}000000`;
-const otlpRandomHex = (bytes) => {
-  const buffer = new Uint8Array(bytes);
-  crypto.getRandomValues(buffer);
-  let hex = "";
-  for (const byte of buffer) {
-    hex += byte.toString(16).padStart(2, "0");
-  }
-  return hex;
-};
-const buildTraceparent = (traceId, spanId) => `00-${traceId}-${spanId}-01`;
-const encodeAttribute = (key, value) => {
-  if (typeof value === "boolean") {
-    return { key, value: { boolValue: value } };
-  }
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      return { key, value: { stringValue: String(value) } };
-    }
-    return Number.isSafeInteger(value) ? { key, value: { intValue: String(value) } } : { key, value: { doubleValue: value } };
-  }
-  return { key, value: { stringValue: value } };
-};
-const mergeHeaders = (defaults, overrides, token) => {
-  const merged = {};
-  const seen = /* @__PURE__ */ new Map();
-  const put = (name, value) => {
-    const lower = name.toLowerCase();
-    const existing = seen.get(lower);
-    if (existing === void 0) {
-      seen.set(lower, name);
-      merged[name] = value;
-    } else {
-      merged[existing] = value;
-    }
-  };
-  for (const [name, value] of Object.entries(defaults)) {
-    put(name, value);
-  }
-  for (const [name, value] of Object.entries(overrides ?? {})) {
-    put(name, value);
-  }
-  if (token !== void 0 && token.length > 0) {
-    put("authorization", `Bearer ${token}`);
-  }
-  return merged;
-};
-const wrapResourceSpans = (span, scopeName, serviceName) => {
-  return {
-    resourceSpans: [
-      {
-        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
-        scopeSpans: [{ scope: { name: scopeName }, spans: [span] }]
-      }
-    ]
-  };
-};
-const wrapResourceLogs = (logRecord, scopeName, serviceName) => {
-  return {
-    resourceLogs: [
-      {
-        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
-        scopeLogs: [{ logRecords: [logRecord], scope: { name: scopeName } }]
-      }
-    ]
-  };
-};
-
-export { OTLP_SEVERITY as O, wrapResourceLogs as a, buildTraceparent as b, otlpUnixNano as c, encodeAttribute as e, mergeHeaders as m, otlpRandomHex as o, wrapResourceSpans as w };

package/dist/packem_shared/toAirbyteMessages-DrHdplb4.mjs

@@ -1,39 +0,0 @@
-const DEFAULT_PRIMARY_KEY = "_id";
-const toFivetranResponse = (page, primaryKey = DEFAULT_PRIMARY_KEY) => {
-  const insert = {};
-  const update = {};
-  const remove = {};
-  const schema = {};
-  const pkFor = (table) => typeof primaryKey === "string" ? primaryKey : primaryKey[table] ?? DEFAULT_PRIMARY_KEY;
-  const bucketFor = (target, table) => {
-    const existing = target[table];
-    if (existing) {
-      return existing;
-    }
-    const created = [];
-    target[table] = created;
-    return created;
-  };
-  for (const change of page.changes) {
-    schema[change.table] ??= { primary_key: [pkFor(change.table)] };
-    if (change.op === "delete") {
-      bucketFor(remove, change.table).push(change.doc);
-    } else if (change.op === "update") {
-      bucketFor(update, change.table).push(change.doc);
-    } else {
-      bucketFor(insert, change.table).push(change.doc);
-    }
-  }
-  return { delete: remove, hasMore: page.hasMore, insert, schema, state: { cursor: page.nextCursor }, update };
-};
-const toAirbyteMessages = (page, emittedAt = Date.now()) => {
-  const messages = [];
-  for (const change of page.changes) {
-    const data = change.op === "delete" ? { ...change.doc, _lunora_deleted: true } : change.doc;
-    messages.push({ record: { data, emitted_at: emittedAt, stream: change.table }, type: "RECORD" });
-  }
-  messages.push({ state: { data: { cursor: page.nextCursor } }, type: "STATE" });
-  return messages;
-};
-
-export { toAirbyteMessages, toFivetranResponse };