@lunora/server 0.0.0 → 1.0.0-alpha.1

package/dist/index.mjs

@@ -0,0 +1,24 @@
+export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
+export { initLunora } from './packem_shared/initLunora-CATvPsVt.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/defineEnv-DjFkpkSP.mjs';
+export { LunoraError } from './packem_shared/LunoraError-DhggBJZF.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindTableFacade-DCuyr46L.mjs';
+export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-B7FYUEgr.mjs';
+export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
+export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/defineSchemaExtension-Ck5_TUO8.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/definePresence-D5LtwGl0.mjs';
+export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-DzqxtAyV.mjs';
+export { anyApi } from './types.mjs';
+export { cronJobs } from '@lunora/scheduler';
+export { ValidationError, v } from '@lunora/values';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/definePolicy-De67zPDS.mjs';
+export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
+export { mask } from './packem_shared/mask-CkZJHHMM.mjs';
+export { rls } from './packem_shared/rls-Zhf5wEeJ.mjs';
+export { storageRules } from './packem_shared/storageRules-4a30FSpI.mjs';
+
+const VERSION = "0.0.0";
+
+export { VERSION };

package/dist/packem_shared/LunoraError-DhggBJZF.mjs

@@ -0,0 +1,51 @@
+const CODE_STATUS = {
+  BAD_REQUEST: 400,
+  CONFLICT: 409,
+  /**
+   * `count()` invoked against a table whose context carries an active RLS
+   * policy. The operation itself is unsupported in an RLS-restricted reader
+   * (kitcn's documented constraint) — the request is well-formed and the
+   * caller is authorized, so this is a 422 (semantic conflict) rather than a
+   * 403 (policy denial).
+   */
+  COUNT_RLS_UNSUPPORTED: 422,
+  FORBIDDEN: 403,
+  INTERNAL_SERVER_ERROR: 500,
+  /**
+   * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
+   * column that the procedure's `mask()` middleware redacts. A masked column
+   * can't be summed, averaged, or grouped without leaking the very values the
+   * mask hides (a group key *is* the raw value; an aggregate is computed from
+   * it), so the operation fails closed. The request is well-formed and the
+   * caller is authorized — this is a 422 (semantic conflict), mirroring
+   * `COUNT_RLS_UNSUPPORTED`.
+   */
+  MASK_UNSUPPORTED: 422,
+  NOT_FOUND: 404,
+  NOT_IMPLEMENTED: 501,
+  /**
+   * A write policy's `when` returned a relation-crossing predicate
+   * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
+   * has no child fetcher and cannot resolve a relation node, so the policy is
+   * unsupported as written. Relation predicates are valid in *read* policies
+   * and query `where` clauses (the pre-resolver handles them there). The
+   * request is well-formed; this is a 422 (semantic conflict), mirroring the
+   * sibling `*_UNSUPPORTED` codes.
+   */
+  RELATION_PREDICATE_UNSUPPORTED: 422,
+  TOO_MANY_REQUESTS: 429,
+  UNAUTHORIZED: 401,
+  UNPROCESSABLE: 422
+};
+class LunoraError extends Error {
+  name = "LunoraError";
+  code;
+  status;
+  constructor(code, message) {
+    super(message ?? code);
+    this.code = code;
+    this.status = CODE_STATUS[code];
+  }
+}
+
+export { LunoraError };

package/dist/packem_shared/asBucketStorage-Cnxd9y2q.mjs

@@ -0,0 +1,11 @@
+const asBucketStorage = (raw) => {
+  const candidate = raw ?? {};
+  if (typeof candidate.bucket === "function") {
+    return candidate;
+  }
+  const self = { ...candidate, bucketName: "default" };
+  self.bucket = () => self;
+  return self;
+};
+
+export { asBucketStorage as default };

package/dist/packem_shared/bindTableFacade-DCuyr46L.mjs

@@ -0,0 +1,71 @@
+const bindTableFacade = (writer, tableName) => {
+  return {
+    aggregate: (options) => writer.aggregate(tableName, options),
+    count: (where) => writer.count(tableName, where),
+    delete: (id) => writer.delete(id, tableName),
+    // `deleteMany`/`patchMany` forward the bound `tableName` as `expectedTable`
+    // (threaded through the writer + the RLS middleware's per-id gate) so every
+    // batched id is scoped to this table — the same IDOR guard the single-row
+    // `delete`/`patch` apply. `patchMany` maps the facade's `values` payload to
+    // the writer's `{ id, patch }` shape.
+    deleteMany: (ids, options) => {
+      if (writer.deleteMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+      }
+      return writer.deleteMany(ids, options, tableName);
+    },
+    findFirst: (args) => writer.findFirst(tableName, args),
+    findFirstOrThrow: (args) => writer.findFirstOrThrow(tableName, args),
+    findMany: (args) => writer.findMany(tableName, args),
+    get: (id) => writer.get(id, tableName),
+    groupBy: (options) => writer.groupBy(tableName, options),
+    insert: (document) => writer.insert(tableName, document),
+    insertMany: (documents, options) => {
+      if (writer.insertMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
+      }
+      return writer.insertMany(tableName, documents, options);
+    },
+    patch: (id, patch) => writer.patch(id, patch, tableName),
+    patchMany: (patches, options) => {
+      if (writer.patchMany === void 0) {
+        throw new Error(`ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+      }
+      return writer.patchMany(
+        patches.map((entry) => {
+          return { id: entry.id, patch: entry.values };
+        }),
+        options,
+        tableName
+      );
+    },
+    rank: (indexName, options) => writer.rank(tableName, indexName, options),
+    rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
+    replace: (id, document) => writer.replace(id, document, tableName),
+    withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
+  };
+};
+const bindOrm = (facade) => {
+  const resolve = (table) => {
+    const bound = facade[table];
+    if (!bound) {
+      throw new Error(`unknown table: ${table}`);
+    }
+    return bound;
+  };
+  return {
+    delete: (table, id) => resolve(table).delete(id),
+    insert: (table) => {
+      return { values: (document) => resolve(table).insert(document) };
+    },
+    query: facade,
+    replace: (table, id) => {
+      return { with: (document) => resolve(table).replace(id, document) };
+    },
+    update: (table, id) => {
+      return { set: (values) => resolve(table).patch(id, values) };
+    }
+  };
+};
+
+export { bindOrm, bindTableFacade };

package/dist/packem_shared/defineAggregateIndex-DzqxtAyV.mjs

@@ -0,0 +1,236 @@
+import { isOrWrapsFromValidator } from '@lunora/values';
+import { mergeSchemaExtension } from './defineSchemaExtension-Ck5_TUO8.mjs';
+
+const relationBuilder = {
+  many: (table, options) => {
+    return { field: options.field, kind: "many", references: options.references ?? "_id", table };
+  },
+  one: (table, options) => {
+    return { field: options.field, kind: "one", onDelete: options.onDelete, references: options.references ?? "_id", table };
+  }
+};
+const makeTrigger = (timing, op, handler) => {
+  return { handler, op, timing };
+};
+const createTriggerBuilder = () => {
+  return {
+    afterDelete: (handler) => makeTrigger("after", "delete", handler),
+    afterInsert: (handler) => makeTrigger("after", "insert", handler),
+    afterUpdate: (handler) => makeTrigger("after", "update", handler),
+    beforeDelete: (handler) => makeTrigger("before", "delete", handler),
+    beforeInsert: (handler) => makeTrigger("before", "insert", handler),
+    beforeUpdate: (handler) => makeTrigger("before", "update", handler)
+  };
+};
+const defineTable = (shape) => {
+  for (const [columnName, validator] of Object.entries(shape)) {
+    if (isOrWrapsFromValidator(validator)) {
+      throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
+    }
+  }
+  const aggregateIndexes = [];
+  const indexes = [];
+  const rankIndexes = [];
+  const relations = {};
+  const searchIndexes = [];
+  const triggers = {};
+  const triggerBuilder = createTriggerBuilder();
+  const vectorIndexes = [];
+  let shardMode = { kind: "root" };
+  let isExternallyManaged = false;
+  let isPublic = false;
+  const builder = {
+    aggregateIndex(name, options) {
+      const op = options?.op ?? "count";
+      if (op !== "count" && !options?.field) {
+        throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+      }
+      aggregateIndexes.push({
+        by: options?.by,
+        field: options?.field,
+        name,
+        // `on` is filled in by `defineSchema` once the table is keyed; we
+        // stash the placeholder so the AggregateIndexDefinition shape stays
+        // straightforward for D1/DO consumers (who read `on`).
+        on: "",
+        op,
+        where: options?.where
+      });
+      return builder;
+    },
+    get aggregateIndexes() {
+      return aggregateIndexes;
+    },
+    externallyManaged() {
+      isExternallyManaged = true;
+      return builder;
+    },
+    global(options) {
+      shardMode = { backend: options?.backend ?? "d1", kind: "global" };
+      return builder;
+    },
+    get isExternallyManaged() {
+      return isExternallyManaged;
+    },
+    get isPublic() {
+      return isPublic;
+    },
+    index(name, fields, options) {
+      indexes.push({ fields, name, unique: options?.unique ?? false });
+      return builder;
+    },
+    get indexes() {
+      return indexes;
+    },
+    public() {
+      isPublic = true;
+      return builder;
+    },
+    rankIndex(name, options) {
+      if (!options.sortBy || options.sortBy.length === 0) {
+        throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+      }
+      const sortBy = options.sortBy.map((key) => {
+        return {
+          direction: key.direction ?? "asc",
+          field: key.field
+        };
+      });
+      rankIndexes.push({
+        name,
+        // `on` is filled in by `defineSchema` once the table is keyed —
+        // same pattern as `aggregateIndex`.
+        on: "",
+        partitionBy: options.partitionBy,
+        sortBy,
+        where: options.where
+      });
+      return builder;
+    },
+    get rankIndexes() {
+      return rankIndexes;
+    },
+    get relationMap() {
+      return relations;
+    },
+    relations(build) {
+      Object.assign(relations, build(relationBuilder));
+      return builder;
+    },
+    searchIndex(name, options) {
+      searchIndexes.push({ field: options.field, filterFields: options.filterFields, name });
+      return builder;
+    },
+    get searchIndexes() {
+      return searchIndexes;
+    },
+    shape,
+    shardBy(field) {
+      shardMode = { field, kind: "shardBy" };
+      return builder;
+    },
+    get shardMode() {
+      return shardMode;
+    },
+    get triggerMap() {
+      return triggers;
+    },
+    triggers(build) {
+      Object.assign(triggers, build(triggerBuilder));
+      return builder;
+    },
+    get vectorIndexes() {
+      return vectorIndexes;
+    },
+    vectorize(field, options) {
+      vectorIndexes.push({
+        dimensions: options.dimensions,
+        embed: options.embed,
+        field,
+        metadata: options.metadata,
+        metric: options.metric,
+        name: options.index
+      });
+      return builder;
+    }
+  };
+  return builder;
+};
+const defineVectorIndex = (options) => {
+  return {
+    dimensions: options.dimensions,
+    embed: options.embed,
+    kind: "vectorIndex",
+    metadata: options.metadata,
+    metric: options.metric,
+    select: options.source.select,
+    table: options.source.table
+  };
+};
+const defineAggregateIndex = (name, options) => {
+  const op = options.op ?? "count";
+  if (op !== "count" && !options.field) {
+    throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+  }
+  return { by: options.by, field: options.field, name, on: options.on, op, where: options.where };
+};
+const defineRankIndex = (name, options) => {
+  if (!options.sortBy || options.sortBy.length === 0) {
+    throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+  }
+  const sortBy = options.sortBy.map((key) => {
+    return {
+      direction: key.direction ?? "asc",
+      field: key.field
+    };
+  });
+  return { name, on: options.table, partitionBy: options.partitionBy, sortBy, where: options.where };
+};
+const withExtend = (schema) => {
+  return {
+    ...schema,
+    extend(extension) {
+      return withExtend(mergeSchemaExtension(schema, extension));
+    },
+    rls(mode) {
+      return withExtend({ ...schema, rlsMode: mode });
+    }
+  };
+};
+const fillIndexTableNames = (tables) => {
+  for (const [tableName, table] of Object.entries(tables)) {
+    for (const index of table.aggregateIndexes) {
+      if (index.on === "") {
+        index.on = tableName;
+      }
+    }
+    for (const index of table.rankIndexes) {
+      if (index.on === "") {
+        index.on = tableName;
+      }
+    }
+  }
+};
+const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
+  for (const index of Object.values(aggregateIndexes)) {
+    const table = tables[index.on];
+    if (!table) {
+      throw new Error(`defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
+    }
+    table.aggregateIndexes.push(index);
+  }
+  for (const index of Object.values(rankIndexes)) {
+    const table = tables[index.on];
+    if (!table) {
+      throw new Error(`defineRankIndex "${index.name}": unknown table "${index.on}"`);
+    }
+    table.rankIndexes.push(index);
+  }
+};
+const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
+  fillIndexTableNames(tables);
+  attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  return withExtend({ tables, vectorIndexes });
+};
+
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex };

package/dist/packem_shared/defineEnv-DjFkpkSP.mjs

@@ -0,0 +1,187 @@
+import { optionalInner } from '@lunora/values';
+
+const SECRET_VALUE_PREFIXES = [
+  /^sk_/u,
+  /^pk_/u,
+  /^rk_/u,
+  /^ghp_/u,
+  /^gho_/u,
+  /^ghs_/u,
+  /^ghr_/u,
+  /^github_pat_/u,
+  /^xox[baprs]-/u,
+  /^AKIA/u,
+  /^AIza/u,
+  /^Bearer\s/u
+];
+const HIGH_ENTROPY_TOKEN = /[\w./+-]{24,}/gu;
+const STANDALONE_TOKEN = /^[\w./+-]+$/u;
+const EMBEDDED_PREFIXED_TOKEN_SHORT = /\b(?:(?:sk|pk|rk|ghp|gho|ghs|ghr)_[\w./+-]*|github_pat_[\w./+-]*|xox[baprs]-[\w./+-]*)/gu;
+const EMBEDDED_PREFIXED_TOKEN_LONG = /\b(?:AKIA|AIza)[\w./+-]+|Bearer\s+[\w./+-]+/gu;
+const URL_CREDENTIAL = /\b([a-z][\w.+-]*:\/\/[\w.%+-]+):[\w.%+-]+@/gu;
+const REDACTED = "[redacted]";
+const SECRET_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
+const looksLikeSecretValue = (value) => {
+  if (SECRET_VALUE_PREFIXES.some((prefix) => prefix.test(value))) {
+    return true;
+  }
+  const trimmed = value.trim();
+  return trimmed.length >= 24 && STANDALONE_TOKEN.test(trimmed);
+};
+const QUOTED_VALUE = /(["'])(?<inner>(?:\\.|(?!\1).)*)\1/gu;
+const KEYED_VALUE = /\b(?<key>[A-Za-z_]\w*)\s*[=:]\s*\S+/gu;
+const redactSecrets = (message) => {
+  let out = message;
+  out = out.replaceAll(QUOTED_VALUE, (match, ...groups) => {
+    const named = groups.at(-1);
+    return named?.inner !== void 0 && looksLikeSecretValue(named.inner) ? REDACTED : match;
+  });
+  out = out.replaceAll(URL_CREDENTIAL, (_match, prefix) => `${prefix}:${REDACTED}@`);
+  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_SHORT, REDACTED);
+  out = out.replaceAll(EMBEDDED_PREFIXED_TOKEN_LONG, REDACTED);
+  out = out.replaceAll(KEYED_VALUE, (match, ...groups) => {
+    const named = groups.at(-1);
+    return named?.key !== void 0 && SECRET_KEY.test(named.key) ? `${named.key}=${REDACTED}` : match;
+  });
+  out = out.replaceAll(HIGH_ENTROPY_TOKEN, REDACTED);
+  return out;
+};
+const redactValueForKey = (message, key, raw) => {
+  const masked = redactSecrets(message);
+  if (typeof raw === "string" && raw !== "" && SECRET_KEY.test(key)) {
+    return masked.replaceAll(raw, REDACTED);
+  }
+  return masked;
+};
+class LunoraEnvError extends Error {
+  name = "LunoraEnvError";
+  failures;
+  constructor(failures) {
+    const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
+    super(`Invalid environment (${String(failures.length)} key(s)):
+${summary}`);
+    this.failures = failures;
+  }
+}
+const TRUE_VALUES = /* @__PURE__ */ new Set(["1", "on", "true", "yes"]);
+const FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+const INTEGER_LITERAL = /^-?\d+$/u;
+const unwrapKind = (validator) => {
+  if (validator.kind !== "optional") {
+    return validator.kind;
+  }
+  const inner = optionalInner(validator);
+  return inner ? unwrapKind(inner) : validator.kind;
+};
+const coerce = (validator, raw) => {
+  if (typeof raw !== "string") {
+    return raw;
+  }
+  switch (unwrapKind(validator)) {
+    case "bigint": {
+      return INTEGER_LITERAL.test(raw.trim()) ? BigInt(raw.trim()) : raw;
+    }
+    case "boolean": {
+      const lowered = raw.trim().toLowerCase();
+      if (TRUE_VALUES.has(lowered)) {
+        return true;
+      }
+      if (FALSE_VALUES.has(lowered)) {
+        return false;
+      }
+      return raw;
+    }
+    case "number": {
+      const trimmed = raw.trim();
+      if (trimmed === "") {
+        return raw;
+      }
+      const parsed = Number(trimmed);
+      return Number.isNaN(parsed) ? raw : parsed;
+    }
+    default: {
+      return raw;
+    }
+  }
+};
+const validateKey = (key, validator, env, failures) => {
+  const raw = env[key];
+  if (raw === void 0 && validator.kind === "optional") {
+    return { ok: true, value: void 0 };
+  }
+  const result = validator.safeParse(coerce(validator, raw));
+  if (result.ok) {
+    return { ok: true, value: result.value };
+  }
+  failures.push({ key, message: redactValueForKey(result.error.message, key, raw) });
+  return { ok: false };
+};
+const requireEnvObject = (env) => {
+  if (typeof env !== "object" || env === null) {
+    throw new LunoraEnvError([{ key: "<env>", message: `expected an object, received ${env === null ? "null" : typeof env}` }]);
+  }
+  return env;
+};
+const defineEnv = (shape) => {
+  const keys = Object.keys(shape);
+  const cache = /* @__PURE__ */ new WeakMap();
+  const accessor = ((env) => {
+    const source = requireEnvObject(env);
+    let resolved = cache.get(source);
+    if (resolved === void 0) {
+      resolved = /* @__PURE__ */ new Map();
+      cache.set(source, resolved);
+    }
+    const cached = resolved;
+    const read = (property) => {
+      if (cached.has(property)) {
+        return cached.get(property);
+      }
+      const failures = [];
+      const outcome = validateKey(property, shape[property], source, failures);
+      if (!outcome.ok) {
+        throw new LunoraEnvError(failures);
+      }
+      cached.set(property, outcome.value);
+      return outcome.value;
+    };
+    return /* @__PURE__ */ new Proxy({}, {
+      get(_target, property) {
+        if (typeof property !== "string" || !(property in shape)) {
+          return void 0;
+        }
+        return read(property);
+      },
+      getOwnPropertyDescriptor(_target, property) {
+        if (typeof property === "string" && property in shape) {
+          return { configurable: true, enumerable: true, value: read(property), writable: false };
+        }
+        return void 0;
+      },
+      has(_target, property) {
+        return typeof property === "string" && property in shape;
+      },
+      ownKeys() {
+        return keys;
+      }
+    });
+  });
+  accessor.parse = (env) => {
+    const source = requireEnvObject(env);
+    const failures = [];
+    const out = {};
+    for (const key of keys) {
+      const outcome = validateKey(key, shape[key], source, failures);
+      if (outcome.ok && outcome.value !== void 0) {
+        out[key] = outcome.value;
+      }
+    }
+    if (failures.length > 0) {
+      throw new LunoraEnvError(failures);
+    }
+    return out;
+  };
+  return accessor;
+};
+
+export { LunoraEnvError, defineEnv, redactSecrets };

package/dist/packem_shared/defineMigration-CAJLr6fx.mjs

@@ -0,0 +1,8 @@
+const defineMigration = (definition) => {
+  if (definition.id.trim() === "") {
+    throw new Error("defineMigration: `id` must be a non-empty string");
+  }
+  return { __lunoraMigration: true, ...definition };
+};
+
+export { defineMigration };

package/dist/packem_shared/definePolicy-De67zPDS.mjs

@@ -0,0 +1,29 @@
+const definePolicy = (input) => {
+  return { on: input.on, table: input.table, when: input.when };
+};
+const createPolicyDsl = () => (input) => {
+  return { on: input.on, table: input.table, when: input.when };
+};
+const definePermission = (name, options = {}) => {
+  return { name, ...options };
+};
+const definePolicies = (policies) => {
+  const seenWhenByKey = /* @__PURE__ */ new Map();
+  for (const policy of policies) {
+    const key = JSON.stringify([policy.table, policy.on]);
+    const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
+    if (whens.has(policy.when)) {
+      throw new Error(
+        `definePolicies: duplicate policy for (table "${policy.table}", on "${policy.on}") — the same decision function is registered more than once. Multiple distinct policies per (table, on) are allowed (reads OR, writes AND); remove the duplicate.`
+      );
+    }
+    whens.add(policy.when);
+    seenWhenByKey.set(key, whens);
+  }
+  return policies;
+};
+const defineRole = (name, options = {}) => {
+  return { name, ...options };
+};
+
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole };