@lunora/server 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/index.d.mts

@@ -2,6 +2,8 @@ import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/va
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
 import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.mjs";
 export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.mjs";
+import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
+export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-BB3pjV0m.mjs";
 export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-BB3pjV0m.mjs";
@@ -226,8 +228,7 @@ interface EnvKeyFailure {
 *
 * Named export only (no default) per the repo export convention.
 */
-declare class LunoraEnvError extends Error {
-  override readonly name = "LunoraEnvError";
+declare class LunoraEnvError extends LunoraError$1 {
   readonly failures: ReadonlyArray<EnvKeyFailure>;
   constructor(failures: ReadonlyArray<EnvKeyFailure>);
 }
@@ -277,63 +278,7 @@ interface EnvAccessor<S extends EnvShape> {
 * invalid — lazily on first access of that key, or eagerly via `config.parse(env)`.
 */
 declare const defineEnv: <S extends EnvShape>(shape: S) => EnvAccessor<S>;
-/**
-* Canonical error type for Lunora procedures and middleware.
-*
-* The runtime's structural error mapper keys off `name === "LunoraError"` plus
-* the numeric `status`, so throwing one of these from a handler or middleware
-* yields the right RPC/HTTP status without any further wiring. `code` carries
-* the machine-readable reason for clients; the optional `data` carries a
-* structured, JSON+wire-encodable payload propagated verbatim to the client
-* (e.g. `{ retryAfterMs }`). Only an explicit `LunoraError`'s `data` crosses the
-* wire — an unhandled throw is still redacted to a generic message server-side.
-*/
-declare const CODE_STATUS: {
-  readonly BAD_REQUEST: 400;
-  readonly CONFLICT: 409;
-  /**
-  * `count()` invoked against a table whose context carries an active RLS
-  * policy. The operation itself is unsupported in an RLS-restricted reader
-  * (kitcn's documented constraint) — the request is well-formed and the
-  * caller is authorized, so this is a 422 (semantic conflict) rather than a
-  * 403 (policy denial).
-  */
-  readonly COUNT_RLS_UNSUPPORTED: 422;
-  readonly FORBIDDEN: 403;
-  readonly INTERNAL_SERVER_ERROR: 500;
-  /**
-  * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
-  * column that the procedure's `mask()` middleware redacts. A masked column
-  * can't be summed, averaged, or grouped without leaking the very values the
-  * mask hides (a group key *is* the raw value; an aggregate is computed from
-  * it), so the operation fails closed. The request is well-formed and the
-  * caller is authorized — this is a 422 (semantic conflict), mirroring
-  * `COUNT_RLS_UNSUPPORTED`.
-  */
-  readonly MASK_UNSUPPORTED: 422;
-  readonly NOT_FOUND: 404;
-  readonly NOT_IMPLEMENTED: 501;
-  /**
-  * A write policy's `when` returned a relation-crossing predicate
-  * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
-  * has no child fetcher and cannot resolve a relation node, so the policy is
-  * unsupported as written. Relation predicates are valid in *read* policies
-  * and query `where` clauses (the pre-resolver handles them there). The
-  * request is well-formed; this is a 422 (semantic conflict), mirroring the
-  * sibling `*_UNSUPPORTED` codes.
-  */
-  readonly RELATION_PREDICATE_UNSUPPORTED: 422;
-  readonly TOO_MANY_REQUESTS: 429;
-  readonly UNAUTHORIZED: 401;
-  readonly UNPROCESSABLE: 422;
-};
-type LunoraErrorCode = keyof typeof CODE_STATUS;
-declare class LunoraError extends Error {
-  override readonly name = "LunoraError";
-  readonly code: LunoraErrorCode;
-  readonly status: number;
-  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
-  readonly data?: unknown;
+declare class LunoraError extends LunoraError$1 {
   constructor(code: LunoraErrorCode, message?: string, data?: unknown);
 }
 /**
@@ -659,6 +604,15 @@ interface ContextWithStorage {
   storage: StorageDownloader;
 }
 /**
+* True when `value` is safe to use as an HTTP header field-value: no CR, LF, or
+* NUL. Guards against response-header injection / `Headers`-construction throws
+* when reflecting attacker-influenced object metadata (e.g. a stored
+* `Content-Type`). Exported (see the `export {}` at the file end) so an `httpAction`
+* handler can guard a request-derived header value before writing it — the fix the
+* `http_action_response_header_injection` advisor lint points to.
+*/
+declare const isSafeHeaderValue: (value: string) => boolean;
+/**
 * Stream a stored object as an HTTP {@link Response} from an `httpAction`
 * handler, with correct `Content-Type`, `ETag`, and `Accept-Ranges: bytes`.
 * Honors a single-range `Range` request → **206 Partial Content** with
@@ -928,21 +882,6 @@ interface MaskContextIn {
 * includes this middleware — opt-in, never global (the same invariant as RLS).
 */
 declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
-/**
-* Online data-migration authoring API.
-*
-* `defineMigration` declares a per-document backfill over one table: `up`
-* transforms every existing row, `down` (optional) reverses it. Unlike the D1
-* SQL schema migrations in `@lunora/d1`, these run *inside each shard's*
-* Durable Object against live documents, in keyset batches, and are resumable —
-* the per-shard runner in `@lunora/do` tracks progress in a reserved
-* `__lunora_migrations` table so an interrupted run picks up where it stopped.
-*
-* The returned object carries a `__lunoraMigration` brand so codegen can
-* discover declarations through the type checker (mirroring the procedure
-* builder's `__lunoraProcedure` brand) and emit them into a `LUNORA_MIGRATIONS`
-* registry the DO and CLI look migrations up by id.
-*/
 /** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
 type MigrationDocument = Record<string, unknown>;
 /**
@@ -2052,4 +1991,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.d.ts

@@ -2,6 +2,8 @@ import { Validator, Infer, ValidatorMap, InferValidatorMap, v } from '@lunora/va
 export { type ColumnValidator, type Id, type Infer, ValidationError, type Validator, type ValidatorKind, v } from '@lunora/values';
 import { ArgsValidator, InferArgs, RegisteredAction, ActionCtx, MutationCtx, RegisteredMutation, QueryCtx, RegisteredQuery, RegisteredStream, FunctionKind, Secrets, LifecycleEvent, RegisteredLifecycleHook, TableDefinition, RegisteredFunction, VectorIndexDefinition, Schema, AggregateOp, DurableObjectJurisdiction, RelationDefinition, GlobalBackend, OnDeleteAction, ExternalSourceDefinition, TriggerBuilder, TriggerDefinition, VectorEmbedder, VectorMetric, AggregateIndexDefinition, RankIndexDefinition } from "./types.js";
 export { type AnyApi, type AuthState, type DatabaseReader, type DatabaseWriter, type FunctionVisibility, type IndexDefinition, type IndexRangeBuilder, type LifecycleEventKind, type LunoraLogger, type PaginationOptions, type PaginationResult, type RankSortKey, type ReadOnlyStorage, type ScheduledFunctionDoc, type ScheduledJob, type Scheduler, type SearchFilterBuilder, type SearchIndexDefinition, type ShardMode, type Storage, type StorageMetadata, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemTableName, type TableReader, type TableVectorIndex, type TriggerAggregateOptions, type TriggerCtx, type TriggerDatabase, type TriggerDeleteEvent, type TriggerEvent, type TriggerGroupByEntry, type TriggerGroupByOptions, type TriggerHandler, type TriggerInsertEvent, type TriggerOp, type TriggerQueryArgs, type TriggerQueryPage, type TriggerRankOptions, type TriggerRankPageOptions, type TriggerRankResult, type TriggerRow, type TriggerTiming, type TriggerUpdateEvent, type VectorMatch, type VectorMatches, type VectorQueryInput, type VectorRecord, type VectorSearch, type VectorSearchReader, type VectorUpsertInput, type WorkflowCreateOptions, type WorkflowHandle, type WorkflowInstance, type WorkflowInstanceStatus, type WorkflowStatusResult, type Workflows, anyApi } from "./types.js";
+import { LunoraError as LunoraError$1, LunoraErrorCode } from '@lunora/errors';
+export type { LunoraErrorCode } from '@lunora/errors';
 import { Context, Hono } from 'hono';
 import { b as Permission, R as Role, T as TypedDefinePolicyInput, a as Policy, D as DefinePolicyInput, W as WhereInput, c as RlsOptions } from "./packem_shared/types.d-Cxl6ndhm.js";
 export type { d as PolicyContext, e as PolicyDecision, f as PolicyDecisionOf, P as PolicyOperation } from "./packem_shared/types.d-Cxl6ndhm.js";
@@ -226,8 +228,7 @@ interface EnvKeyFailure {
 *
 * Named export only (no default) per the repo export convention.
 */
-declare class LunoraEnvError extends Error {
-  override readonly name = "LunoraEnvError";
+declare class LunoraEnvError extends LunoraError$1 {
   readonly failures: ReadonlyArray<EnvKeyFailure>;
   constructor(failures: ReadonlyArray<EnvKeyFailure>);
 }
@@ -277,63 +278,7 @@ interface EnvAccessor<S extends EnvShape> {
 * invalid — lazily on first access of that key, or eagerly via `config.parse(env)`.
 */
 declare const defineEnv: <S extends EnvShape>(shape: S) => EnvAccessor<S>;
-/**
-* Canonical error type for Lunora procedures and middleware.
-*
-* The runtime's structural error mapper keys off `name === "LunoraError"` plus
-* the numeric `status`, so throwing one of these from a handler or middleware
-* yields the right RPC/HTTP status without any further wiring. `code` carries
-* the machine-readable reason for clients; the optional `data` carries a
-* structured, JSON+wire-encodable payload propagated verbatim to the client
-* (e.g. `{ retryAfterMs }`). Only an explicit `LunoraError`'s `data` crosses the
-* wire — an unhandled throw is still redacted to a generic message server-side.
-*/
-declare const CODE_STATUS: {
-  readonly BAD_REQUEST: 400;
-  readonly CONFLICT: 409;
-  /**
-  * `count()` invoked against a table whose context carries an active RLS
-  * policy. The operation itself is unsupported in an RLS-restricted reader
-  * (kitcn's documented constraint) — the request is well-formed and the
-  * caller is authorized, so this is a 422 (semantic conflict) rather than a
-  * 403 (policy denial).
-  */
-  readonly COUNT_RLS_UNSUPPORTED: 422;
-  readonly FORBIDDEN: 403;
-  readonly INTERNAL_SERVER_ERROR: 500;
-  /**
-  * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
-  * column that the procedure's `mask()` middleware redacts. A masked column
-  * can't be summed, averaged, or grouped without leaking the very values the
-  * mask hides (a group key *is* the raw value; an aggregate is computed from
-  * it), so the operation fails closed. The request is well-formed and the
-  * caller is authorized — this is a 422 (semantic conflict), mirroring
-  * `COUNT_RLS_UNSUPPORTED`.
-  */
-  readonly MASK_UNSUPPORTED: 422;
-  readonly NOT_FOUND: 404;
-  readonly NOT_IMPLEMENTED: 501;
-  /**
-  * A write policy's `when` returned a relation-crossing predicate
-  * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
-  * has no child fetcher and cannot resolve a relation node, so the policy is
-  * unsupported as written. Relation predicates are valid in *read* policies
-  * and query `where` clauses (the pre-resolver handles them there). The
-  * request is well-formed; this is a 422 (semantic conflict), mirroring the
-  * sibling `*_UNSUPPORTED` codes.
-  */
-  readonly RELATION_PREDICATE_UNSUPPORTED: 422;
-  readonly TOO_MANY_REQUESTS: 429;
-  readonly UNAUTHORIZED: 401;
-  readonly UNPROCESSABLE: 422;
-};
-type LunoraErrorCode = keyof typeof CODE_STATUS;
-declare class LunoraError extends Error {
-  override readonly name = "LunoraError";
-  readonly code: LunoraErrorCode;
-  readonly status: number;
-  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
-  readonly data?: unknown;
+declare class LunoraError extends LunoraError$1 {
   constructor(code: LunoraErrorCode, message?: string, data?: unknown);
 }
 /**
@@ -659,6 +604,15 @@ interface ContextWithStorage {
   storage: StorageDownloader;
 }
 /**
+* True when `value` is safe to use as an HTTP header field-value: no CR, LF, or
+* NUL. Guards against response-header injection / `Headers`-construction throws
+* when reflecting attacker-influenced object metadata (e.g. a stored
+* `Content-Type`). Exported (see the `export {}` at the file end) so an `httpAction`
+* handler can guard a request-derived header value before writing it — the fix the
+* `http_action_response_header_injection` advisor lint points to.
+*/
+declare const isSafeHeaderValue: (value: string) => boolean;
+/**
 * Stream a stored object as an HTTP {@link Response} from an `httpAction`
 * handler, with correct `Content-Type`, `ETag`, and `Accept-Ranges: bytes`.
 * Honors a single-range `Range` request → **206 Partial Content** with
@@ -928,21 +882,6 @@ interface MaskContextIn {
 * includes this middleware — opt-in, never global (the same invariant as RLS).
 */
 declare const mask: <Context extends MaskContextIn = MaskContextIn>(policies: MaskPolicies<Context>, options?: MaskOptions<Context>) => Middleware<Context, Context>;
-/**
-* Online data-migration authoring API.
-*
-* `defineMigration` declares a per-document backfill over one table: `up`
-* transforms every existing row, `down` (optional) reverses it. Unlike the D1
-* SQL schema migrations in `@lunora/d1`, these run *inside each shard's*
-* Durable Object against live documents, in keyset batches, and are resumable —
-* the per-shard runner in `@lunora/do` tracks progress in a reserved
-* `__lunora_migrations` table so an interrupted run picks up where it stopped.
-*
-* The returned object carries a `__lunoraMigration` brand so codegen can
-* discover declarations through the type checker (mirroring the procedure
-* builder's `__lunoraProcedure` brand) and emit them into a `LUNORA_MIGRATIONS`
-* registry the DO and CLI look migrations up by id.
-*/
 /** A document handed to a migration transform: the stored row including `_id`/`_creationTime`. */
 type MigrationDocument = Record<string, unknown>;
 /**
@@ -2052,4 +1991,4 @@ interface StorageContextIn {
 }
 declare const storageRules: <Context extends StorageContextIn = StorageContextIn>(rules: ReadonlyArray<StorageRule<Context>>, options?: StorageRulesOptions) => Middleware<Context, Context>;
 declare const VERSION = "0.0.0";
-export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraErrorCode, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };
+export { type ActionBuilder, type ActionCtx, type AggregateIndexDefinition, type AggregateIndexOptions, type AggregateOp, type ArgsValidator, type Component, type ComponentFunctions, type CreateOptions, type DataModelInit, type DefineComponentOptions, type DefineIdentityOptions, type DefinePluginOptions, type DefinePolicyInput, type DefinePresenceOptions, type DefineStorageRuleInput, type DurableObjectJurisdiction, type EmptyArgs, type EnvAccessor, type EnvKeyFailure, type EnvShape, type ExtendableSchema, type FacadeEntry, type FacadeWriterLike, type FunctionKind, type HttpActionCtx, type HttpActionHandler, type HttpMethod, type HttpRoute, type HttpRouteBuilder, type HttpRouteFactory, type HttpRouteHandlerOptions, type HttpStreamHandlerOptions, type IdentityContract, type IdentityRejectMode, type IdentityValidation, type InferArgs, type InferEnv, type InferIdentity, type InlineAggregateIndexOptions, type InlineRankIndexOptions, type InternalActionBuilder, type InternalMutationBuilder, type InternalQueryBuilder, type LifecycleEvent, type LifecycleHandler, type LunoraBuilders, LunoraEnvError, LunoraError, type LunoraHttpApp, type LunoraHttpEnv, type LunoraRouteHandler, type ManyRelation, type MaskColumns, type MaskContext, type MaskFn, type MaskOptions, type MaskPolicies, type MaskStrategy, type Middleware, type MiddlewareNext, type MigrationDefinition, type MigrationDocument, type MigrationTransform, type MutationBuilder, type MutationCtx, type MutatorDefinition, type OnDeleteAction, type OneRelation, type OrmLike, DEFAULT_TTL_MS as PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, type Permission, type Plugin, type Policy, type PrefixedTables, type PresenceComponent, type PresenceFunctions, type PresenceMember, type ProtectPublicOptions, type QueryBuilder, type QueryCtx, type RankIndexDefinition, type RankIndexOptions, type RegisteredAction, type RegisteredFunction, type RegisteredLifecycleHook, type RegisteredMigration, type RegisteredMutation, type RegisteredMutator, type RegisteredQuery, type RegisteredShape, type RegisteredStream, type RelationBuilder, type RelationDefinition, type RlsOptions, type RlsReadRegistry, type Role, type Schema, type SchemaExtension, type ShapeDefinition, type ShapeReadWhereRequest, type StorageOperation, type StorageRule, type StorageRuleContext, type StorageRuleDecision, type StorageRulesOptions, type TableBuilder, type TableDefinition, type TerminalKind, type TriggerBuilder, type TriggerDefinition, type TypedDefinePolicyInput, VERSION, type VectorEmbedder, type VectorIndexDefinition, type VectorIndexOptions, type VectorMetric, type VectorizeOptions, type WhereInput, asBucketStorage, bindOrm, bindTableFacade, buildRlsReadRegistry, composePluginMiddleware, composeShapeReadWhere, createPolicyDsl, createSecrets, defineAggregateIndex, defineComponent, defineEnv, defineIdentity, defineMigration, defineMutator, definePermission, definePlugin, definePolicies, definePolicy, definePresence, defineRankIndex, defineRole, defineSchema, defineSchemaExtension, defineShape, defineStorageRule, defineStorageRules, defineTable, defineVectorIndex, httpAction, httpRoute, httpRouter, initLunora, installPlugins, isSafeHeaderValue, mask, mergeSchemaExtension, onConnect, onDisconnect, presenceExtension, protectPublic, redactSecrets, rls, serveStorageObject, storageRules };

package/dist/index.mjs

@@ -1,28 +1,28 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-lxwHTEV3.mjs';
-export { createSecrets } from './packem_shared/createSecrets-TsIP9lOa.mjs';
-export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
-export { LunoraError } from './packem_shared/LunoraError-DN7Zhhvu.mjs';
-export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Ce57S3N9.mjs';
-export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-FLwfsePg.mjs';
-export { defineIdentity } from './packem_shared/defineIdentity-B_9YD46A.mjs';
+export { initLunora } from './packem_shared/initLunora-sQUqaejx.mjs';
+export { createSecrets } from './packem_shared/createSecrets-DwaR2rNG.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-BGmd1Qs0.mjs';
+export { LunoraError } from './packem_shared/LunoraError-WbxmrpxR.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-CNXKgfUa.mjs';
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject } from './packem_shared/httpAction-B_16WzMO.mjs';
+export { defineIdentity } from './packem_shared/defineIdentity-DiX4zM9x.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
-export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
+export { defineMigration } from './packem_shared/defineMigration-Hx01yIht.mjs';
 export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
-export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs';
-export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-ZdyU78gh.mjs';
-export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-CcTj1_v2.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-BtPCiNLW.mjs';
+export { protectPublic } from './packem_shared/protectPublic-BlcGpiRc.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-znq4ygKQ.mjs';
+export { defineShape } from './packem_shared/defineShape-C5scNOrf.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-Do1CSBTr.mjs';
-export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
-export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-E8MgAS3N.mjs';
-export { rls } from './packem_shared/rls-DhNgKFeW.mjs';
-export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-DFBFLydB.mjs';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-By3QB4he.mjs';
+export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-B5nL4Z1P.mjs';
+export { mask } from './packem_shared/mask-Dc8G5Gl7.mjs';
+export { rls } from './packem_shared/rls-3sCJIH6F.mjs';
+export { storageRules } from './packem_shared/storageRules-6QxzDOcx.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/{LunoraEnvError-DjFkpkSP.mjs → LunoraEnvError-BGmd1Qs0.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { optionalInner } from '@lunora/values';
 
 const SECRET_VALUE_PREFIXES = [
@@ -53,13 +54,12 @@ const redactValueForKey = (message, key, raw) => {
   }
   return masked;
 };
-class LunoraEnvError extends Error {
-  name = "LunoraEnvError";
+class LunoraEnvError extends LunoraError$1 {
   failures;
   constructor(failures) {
     const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
-    super(`Invalid environment (${String(failures.length)} key(s)):
-${summary}`);
+    super("ENV_INVALID", `Invalid environment (${String(failures.length)} key(s)):
+${summary}`, { name: "LunoraEnvError" });
     this.failures = failures;
   }
 }

package/dist/packem_shared/LunoraError-WbxmrpxR.mjs

@@ -0,0 +1,9 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+class LunoraError extends LunoraError$1 {
+  constructor(code, message, data) {
+    super(code, message, { data });
+  }
+}
+
+export { LunoraError };

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-D8viLY1S.mjs → PRESENCE_DEFAULT_TTL_MS-BtPCiNLW.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-lxwHTEV3.mjs';
-import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { initLunora } from './initLunora-sQUqaejx.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
-import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
-import { defineTable } from './defineAggregateIndex-ZdyU78gh.mjs';
+import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-CcTj1_v2.mjs';
+import { defineTable } from './defineAggregateIndex-znq4ygKQ.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;

package/dist/packem_shared/{bindOrm-Ce57S3N9.mjs → bindOrm-CNXKgfUa.mjs}

@@ -1,13 +1,15 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
 const buildUpsertWhere = (tableName, target, create) => {
   const fields = typeof target === "string" ? [target] : target;
   if (fields.length === 0) {
-    throw new Error(`ctx.db.${tableName}.upsert: "target" must name at least one field`);
+    throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: "target" must name at least one field`);
   }
   const where = {};
   for (const field of fields) {
     if (!(field in create)) {
-      throw new Error(`ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
+      throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
     }
     where[field] = create[field];
   }
@@ -48,7 +50,7 @@ const bindTableFacade = (writer, tableName) => {
     // the writer's `{ id, patch }` shape.
     deleteMany: (ids, options) => {
       if (writer.deleteMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
       }
       return writer.deleteMany(ids, options, tableName);
     },
@@ -65,14 +67,14 @@ const bindTableFacade = (writer, tableName) => {
     insert,
     insertMany: (documents, options) => {
       if (writer.insertMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
       }
       return writer.insertMany(tableName, documents, options);
     },
     patch: (id, patch) => writer.patch(id, patch, tableName),
     patchMany: (patches, options) => {
       if (writer.patchMany === void 0) {
-        throw new Error(`ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
       }
       return writer.patchMany(
         patches.map((entry) => {
@@ -87,7 +89,7 @@ const bindTableFacade = (writer, tableName) => {
     replace: (id, document) => writer.replace(id, document, tableName),
     restore: async (id) => {
       if (!writer.restore) {
-        throw new Error(`ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
       }
       await writer.restore(id, tableName);
     },
@@ -106,7 +108,7 @@ const bindOrm = (facade) => {
   const resolve = (table) => {
     const bound = facade[table];
     if (!bound) {
-      throw new Error(`unknown table: ${table}`);
+      throw new LunoraError$1("INTERNAL", `unknown table: ${table}`);
     }
     return bound;
   };

package/dist/packem_shared/{buildRlsReadRegistry-Do1CSBTr.mjs → buildRlsReadRegistry-DFBFLydB.mjs}

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-DhNgKFeW.mjs';
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-3sCJIH6F.mjs';
 import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 
 const FALSE_PREDICATE = { OR: [] };

package/dist/packem_shared/{composePluginMiddleware-Ck5_TUO8.mjs → composePluginMiddleware-CcTj1_v2.mjs}

@@ -1,4 +1,5 @@
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const prefixTableName = (key, bareName) => `${key}_${bareName}`;
 const rewriteReference = (target, key, bareNames) => bareNames.has(target) ? prefixTableName(key, target) : target;
@@ -19,7 +20,7 @@ const rewriteTableReferences = (table, key, bareNames, ownBareName) => {
 };
 const defineSchemaExtension = (key, options) => {
   if (!key) {
-    throw new Error("defineSchemaExtension: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineSchemaExtension: `key` is required and must be a non-empty string");
   }
   return {
     key,
@@ -29,10 +30,10 @@ const defineSchemaExtension = (key, options) => {
 };
 const definePlugin = (key, options) => {
   if (!key) {
-    throw new Error("definePlugin: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "definePlugin: `key` is required and must be a non-empty string");
   }
   if (options.extension && options.extension.key !== key) {
-    throw new Error(`definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
+    throw new LunoraError$1("INTERNAL", `definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
   }
   return {
     key,
@@ -57,7 +58,8 @@ const mergeSchemaExtension = (base, extension) => {
   for (const [bareName, table] of Object.entries(extension.tables)) {
     const prefixed = prefixTableName(key, bareName);
     if (Object.hasOwn(merged, prefixed)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema(...).extend("${key}"): table "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
       );
     }
@@ -68,7 +70,8 @@ const mergeSchemaExtension = (base, extension) => {
     for (const [bareIndexName, index] of Object.entries(extension.vectorIndexes)) {
       const prefixed = prefixTableName(key, bareIndexName);
       if (Object.hasOwn(mergedVectorIndexes, prefixed)) {
-        throw new Error(
+        throw new LunoraError$1(
+          "INTERNAL",
           `defineSchema(...).extend("${key}"): vector index "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
         );
       }

package/dist/packem_shared/{createPolicyDsl-De67zPDS.mjs → createPolicyDsl-By3QB4he.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const definePolicy = (input) => {
   return { on: input.on, table: input.table, when: input.when };
 };
@@ -13,7 +15,8 @@ const definePolicies = (policies) => {
     const key = JSON.stringify([policy.table, policy.on]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(policy.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `definePolicies: duplicate policy for (table "${policy.table}", on "${policy.on}") — the same decision function is registered more than once. Multiple distinct policies per (table, on) are allowed (reads OR, writes AND); remove the duplicate.`
       );
     }

package/dist/packem_shared/{createSecrets-TsIP9lOa.mjs → createSecrets-DwaR2rNG.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const NON_SECRET_BINDING_METHODS = [
   "put",
   // KV / R2
@@ -43,7 +45,8 @@ const createSecrets = (env) => {
     get: async (name) => {
       const binding = env[name];
       if (!isSecretBinding(binding)) {
-        throw new Error(
+        throw new LunoraError$1(
+          "INTERNAL",
           `ctx.secrets: no Secrets Store binding named "${name}". Add a \`secrets_store_secrets[]\` entry (binding "${name}", pointing at your store + secret) to wrangler.jsonc — \`ctx.secrets\` reads a Secrets Store binding, not a plain \`.dev.vars\` value.`
         );
       }

package/dist/packem_shared/{defineAggregateIndex-ZdyU78gh.mjs → defineAggregateIndex-znq4ygKQ.mjs}

@@ -1,5 +1,6 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { isOrWrapsFromValidator, v } from '@lunora/values';
-import { mergeSchemaExtension } from './composePluginMiddleware-Ck5_TUO8.mjs';
+import { mergeSchemaExtension } from './composePluginMiddleware-CcTj1_v2.mjs';
 
 const relationBuilder = {
   many: (table, options) => {
@@ -26,7 +27,7 @@ const defineTable = (inputShape) => {
   const shape = { ...inputShape };
   for (const [columnName, validator] of Object.entries(shape)) {
     if (isOrWrapsFromValidator(validator)) {
-      throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
+      throw new LunoraError$1("INTERNAL", `defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
     }
   }
   const aggregateIndexes = [];
@@ -46,7 +47,7 @@ const defineTable = (inputShape) => {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
       if (op !== "count" && !options?.field) {
-        throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+        throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
       }
       aggregateIndexes.push({
         by: options?.by,
@@ -94,7 +95,7 @@ const defineTable = (inputShape) => {
     },
     rankIndex(name, options) {
       if (!options.sortBy || options.sortBy.length === 0) {
-        throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+        throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
       }
       const sortBy = options.sortBy.map((key) => {
         return {
@@ -143,10 +144,10 @@ const defineTable = (inputShape) => {
     },
     source(definition) {
       if (!definition.binding) {
-        throw new Error("source: `binding` is required (the wrangler Hyperdrive binding name)");
+        throw new LunoraError$1("INTERNAL", "source: `binding` is required (the wrangler Hyperdrive binding name)");
       }
       if (!definition.query) {
-        throw new Error("source: `query` is required (the tenant-membership SQL)");
+        throw new LunoraError$1("INTERNAL", "source: `query` is required (the tenant-membership SQL)");
       }
       externalSource = definition;
       isExternallyManaged = true;
@@ -198,13 +199,13 @@ const defineVectorIndex = (options) => {
 const defineAggregateIndex = (name, options) => {
   const op = options.op ?? "count";
   if (op !== "count" && !options.field) {
-    throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+    throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
   }
   return { by: options.by, field: options.field, name, on: options.on, op, where: options.where };
 };
 const defineRankIndex = (name, options) => {
   if (!options.sortBy || options.sortBy.length === 0) {
-    throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+    throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
   }
   const sortBy = options.sortBy.map((key) => {
     return {
@@ -246,14 +247,14 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
   for (const index of Object.values(aggregateIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.aggregateIndexes.push(index);
   }
   for (const index of Object.values(rankIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineRankIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineRankIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.rankIndexes.push(index);
   }
@@ -265,17 +266,20 @@ const validateExternalSources = (tables) => {
       continue;
     }
     if (table.shardMode.kind === "global") {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
       );
     }
     if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
       );
     }
     if (source.mode === "incremental") {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema: table "${name}" uses \`mode: "incremental"\`, which is not yet implemented — only "full-pull" (the default) is supported. Remove \`mode\` or set it to "full-pull".`
       );
     }

package/dist/packem_shared/{defineIdentity-B_9YD46A.mjs → defineIdentity-DiX4zM9x.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 
 const NON_STRING_USER_ID_KINDS = /* @__PURE__ */ new Set([
@@ -17,7 +18,7 @@ const defineIdentity = (claims, options = {}) => {
   const map = claims;
   const userIdValidator = map["userId"];
   if (userIdValidator === void 0 || NON_STRING_USER_ID_KINDS.has(userIdValidator.kind)) {
-    throw new Error("defineIdentity: the claim map must declare a required string `userId` validator (e.g. `v.string()` or `v.id(...)`)");
+    throw new LunoraError$1("INTERNAL", "defineIdentity: the claim map must declare a required string `userId` validator (e.g. `v.string()` or `v.id(...)`)");
   }
   const onInvalid = options.onInvalid ?? "anonymous";
   const validate = (identity) => {

package/dist/packem_shared/{defineMigration-CAJLr6fx.mjs → defineMigration-Hx01yIht.mjs}

@@ -1,6 +1,8 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineMigration = (definition) => {
   if (definition.id.trim() === "") {
-    throw new Error("defineMigration: `id` must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineMigration: `id` must be a non-empty string");
   }
   return { __lunoraMigration: true, ...definition };
 };

package/dist/packem_shared/{defineShape-CJ27Wx7o.mjs → defineShape-C5scNOrf.mjs}

@@ -1,11 +1,12 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { v as validateArgs } from './functions-Di9FUNkf.mjs';
 
 const defineShape = (definition) => {
   if (definition.table.trim() === "") {
-    throw new Error("defineShape: `table` must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineShape: `table` must be a non-empty string");
   }
   if (definition.columns?.length === 0) {
-    throw new Error("defineShape: `columns` must list at least one column when provided");
+    throw new LunoraError$1("INTERNAL", "defineShape: `columns` must list at least one column when provided");
   }
   const compileWhere = (context, rawArgs) => {
     const parsed = validateArgs(definition.args ?? {}, rawArgs);

package/dist/packem_shared/{defineStorageRule-qu0mpilX.mjs → defineStorageRule-B5nL4Z1P.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineStorageRule = (input) => {
   return { bucket: input.bucket, on: input.on, prefix: input.prefix, when: input.when };
 };
@@ -7,7 +9,8 @@ const defineStorageRules = (rules) => {
     const key = JSON.stringify([rule.bucket, rule.on, rule.prefix]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(rule.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineStorageRules: duplicate rule for (bucket "${rule.bucket}", on "${rule.on}"${rule.prefix === void 0 ? "" : `, prefix "${rule.prefix}"`}) — the same decision function is registered more than once. Multiple distinct rules per (bucket, on) are allowed (they OR); remove the duplicate.`
       );
     }

package/dist/packem_shared/{httpAction-FLwfsePg.mjs → httpAction-B_16WzMO.mjs}

@@ -1,6 +1,7 @@
+import { toErrorBody } from '@lunora/errors';
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 import { Hono } from 'hono';
-import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 
 const httpAction = (handler) => async (c) => handler(c.get("lunora"), c.req.raw);
 const httpRouter = () => {
@@ -126,13 +127,6 @@ const buildRouteHandler = (state, userHandler) => async (c) => {
     return errorResponse(error);
   }
 };
-const isLunoraErrorLike = (error) => {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const candidate = error;
-  return candidate.name === "LunoraError" && typeof candidate.code === "string" && typeof candidate.message === "string";
-};
 const sseFrame = (chunk, event) => {
   const data = JSON.stringify(chunk);
   const prefix = event ? `event: ${event}
@@ -193,14 +187,11 @@ const buildStreamHandler = (state, userHandler) => (
           }
           controller.enqueue(encoder.encode(sseFrame({}, "complete")));
         } catch (error) {
-          let payload;
-          if (isLunoraErrorLike(error)) {
-            payload = { code: error.code, message: error.message };
-          } else {
+          const { body, redacted } = toErrorBody(error, { fallbackCode: "INTERNAL_SERVER_ERROR", redactedMessage: "Internal error" });
+          if (redacted) {
             console.error("[lunora] unhandled stream handler error:", error);
-            payload = { code: "INTERNAL_SERVER_ERROR", message: "Internal error" };
           }
-          controller.enqueue(encoder.encode(sseFrame(payload, "error")));
+          controller.enqueue(encoder.encode(sseFrame({ code: body.code, message: body.message }, "error")));
         } finally {
           request.signal.removeEventListener("abort", onAbort);
           controller.close();
@@ -337,4 +328,4 @@ const serveStorageObject = async (context, key, request) => {
   });
 };
 
-export { httpAction, httpRoute, httpRouter, serveStorageObject };
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject };

package/dist/packem_shared/{initLunora-lxwHTEV3.mjs → initLunora-sQUqaejx.mjs}

@@ -1,6 +1,6 @@
 import { v as validateArgs } from './functions-Di9FUNkf.mjs';
 import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {

package/dist/packem_shared/{mask-E8MgAS3N.mjs → mask-Dc8G5Gl7.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-CNXKgfUa.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles) => {

package/dist/packem_shared/{protectPublic-BjFkQ_Or.mjs → protectPublic-BlcGpiRc.mjs}

@@ -1,4 +1,4 @@
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const protectPublic = (options) => {
   const chain = [options.rateLimit, options.captcha, ...options.use ?? []].filter(

package/dist/packem_shared/{rls-DhNgKFeW.mjs → rls-3sCJIH6F.mjs}

@@ -1,5 +1,5 @@
-import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
-import { bindTableFacade, bindOrm } from './bindOrm-Ce57S3N9.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
+import { bindTableFacade, bindOrm } from './bindOrm-CNXKgfUa.mjs';
 import { t as tagRlsMiddleware } from './policy-tag-DvpVH2tv.mjs';
 
 const DEFAULT_BATCH_LIMIT = 500;

package/dist/packem_shared/{run-middleware-CYQOuoV6.mjs → run-middleware-I6EiQfxL.mjs}

@@ -1,8 +1,10 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const runMiddlewareChain = async (middlewares, baseContext, terminal) => {
   let lastIndex = -1;
   const dispatch = async (index, context) => {
     if (index <= lastIndex) {
-      throw new Error("middleware next() called multiple times");
+      throw new LunoraError$1("INTERNAL", "middleware next() called multiple times");
     }
     lastIndex = index;
     const middleware = middlewares[index];

package/dist/packem_shared/{storageRules-Cje6Woea.mjs → storageRules-6QxzDOcx.mjs}

@@ -1,4 +1,4 @@
-import { LunoraError } from './LunoraError-DN7Zhhvu.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 
 const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
 const indexRolePermissions = (roles = []) => {

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-DhNgKFeW.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-3sCJIH6F.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.13",
+  "version": "1.0.0-alpha.15",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",
@@ -62,8 +62,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/scheduler": "1.0.0-alpha.4",
-    "@lunora/values": "1.0.0-alpha.3",
+    "@lunora/errors": "1.0.0-alpha.1",
+    "@lunora/scheduler": "1.0.0-alpha.5",
+    "@lunora/values": "1.0.0-alpha.4",
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27"
   },

package/dist/packem_shared/LunoraError-DN7Zhhvu.mjs

@@ -1,54 +0,0 @@
-const CODE_STATUS = {
-  BAD_REQUEST: 400,
-  CONFLICT: 409,
-  /**
-   * `count()` invoked against a table whose context carries an active RLS
-   * policy. The operation itself is unsupported in an RLS-restricted reader
-   * (kitcn's documented constraint) — the request is well-formed and the
-   * caller is authorized, so this is a 422 (semantic conflict) rather than a
-   * 403 (policy denial).
-   */
-  COUNT_RLS_UNSUPPORTED: 422,
-  FORBIDDEN: 403,
-  INTERNAL_SERVER_ERROR: 500,
-  /**
-   * An analytical reduction (`aggregate` / `groupBy`) was invoked over a
-   * column that the procedure's `mask()` middleware redacts. A masked column
-   * can't be summed, averaged, or grouped without leaking the very values the
-   * mask hides (a group key *is* the raw value; an aggregate is computed from
-   * it), so the operation fails closed. The request is well-formed and the
-   * caller is authorized — this is a 422 (semantic conflict), mirroring
-   * `COUNT_RLS_UNSUPPORTED`.
-   */
-  MASK_UNSUPPORTED: 422,
-  NOT_FOUND: 404,
-  NOT_IMPLEMENTED: 501,
-  /**
-   * A write policy's `when` returned a relation-crossing predicate
-   * (`some`/`none`/`every`/`is`/`isNot`). The in-memory write-policy evaluator
-   * has no child fetcher and cannot resolve a relation node, so the policy is
-   * unsupported as written. Relation predicates are valid in *read* policies
-   * and query `where` clauses (the pre-resolver handles them there). The
-   * request is well-formed; this is a 422 (semantic conflict), mirroring the
-   * sibling `*_UNSUPPORTED` codes.
-   */
-  RELATION_PREDICATE_UNSUPPORTED: 422,
-  TOO_MANY_REQUESTS: 429,
-  UNAUTHORIZED: 401,
-  UNPROCESSABLE: 422
-};
-class LunoraError extends Error {
-  name = "LunoraError";
-  code;
-  status;
-  /** Structured, JSON+wire-encodable payload surfaced to the client alongside `code`. */
-  data;
-  constructor(code, message, data) {
-    super(message ?? code);
-    this.code = code;
-    this.status = CODE_STATUS[code];
-    this.data = data;
-  }
-}
-
-export { LunoraError };