@lunora/server 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/index.mjs

@@ -1,23 +1,28 @@
 export { default as asBucketStorage } from './packem_shared/asBucketStorage-Cnxd9y2q.mjs';
-export { initLunora } from './packem_shared/initLunora-CATvPsVt.mjs';
-export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-DjFkpkSP.mjs';
-export { LunoraError } from './packem_shared/LunoraError-DhggBJZF.mjs';
-export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-DCuyr46L.mjs';
-export { httpAction, httpRoute, httpRouter, serveStorageObject } from './packem_shared/httpAction-B7FYUEgr.mjs';
+export { initLunora } from './packem_shared/initLunora-sQUqaejx.mjs';
+export { createSecrets } from './packem_shared/createSecrets-DwaR2rNG.mjs';
+export { LunoraEnvError, defineEnv, redactSecrets } from './packem_shared/LunoraEnvError-BGmd1Qs0.mjs';
+export { LunoraError } from './packem_shared/LunoraError-WbxmrpxR.mjs';
+export { bindOrm, bindTableFacade } from './packem_shared/bindOrm-Bfgl7f-Q.mjs';
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject } from './packem_shared/httpAction-DCXoYPIk.mjs';
+export { defineIdentity } from './packem_shared/defineIdentity-DiX4zM9x.mjs';
 export { onConnect, onDisconnect } from './packem_shared/onConnect-CIPXKPyw.mjs';
-export { defineMigration } from './packem_shared/defineMigration-CAJLr6fx.mjs';
-export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-Ck5_TUO8.mjs';
-export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-BZYd5-uo.mjs';
-export { protectPublic } from './packem_shared/protectPublic-BjFkQ_Or.mjs';
-export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-DxSso0rH.mjs';
+export { defineMigration } from './packem_shared/defineMigration-Hx01yIht.mjs';
+export { defineMutator } from './packem_shared/defineMutator-EIXAWhs9.mjs';
+export { composePluginMiddleware, defineComponent, definePlugin, defineSchemaExtension, installPlugins, mergeSchemaExtension } from './packem_shared/composePluginMiddleware-CcTj1_v2.mjs';
+export { PRESENCE_DEFAULT_TTL_MS, PRESENCE_TABLE, definePresence, presenceExtension } from './packem_shared/PRESENCE_DEFAULT_TTL_MS-BtPCiNLW.mjs';
+export { protectPublic } from './packem_shared/protectPublic-BlcGpiRc.mjs';
+export { defineAggregateIndex, defineRankIndex, defineSchema, defineTable, defineVectorIndex } from './packem_shared/defineAggregateIndex-znq4ygKQ.mjs';
+export { defineShape } from './packem_shared/defineShape-C5scNOrf.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
-export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-Jc84C_hK.mjs';
-export { rls } from './packem_shared/rls-BDKRbMCA.mjs';
-export { storageRules } from './packem_shared/storageRules-4a30FSpI.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-D54vUQe4.mjs';
+export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-By3QB4he.mjs';
+export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-B5nL4Z1P.mjs';
+export { mask } from './packem_shared/mask-BT1YgRbF.mjs';
+export { rls } from './packem_shared/rls-B_ZWgslr.mjs';
+export { storageRules } from './packem_shared/storageRules-6QxzDOcx.mjs';
 
 const VERSION = "0.0.0";
 

package/dist/packem_shared/{LunoraEnvError-DjFkpkSP.mjs → LunoraEnvError-BGmd1Qs0.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { optionalInner } from '@lunora/values';
 
 const SECRET_VALUE_PREFIXES = [
@@ -53,13 +54,12 @@ const redactValueForKey = (message, key, raw) => {
   }
   return masked;
 };
-class LunoraEnvError extends Error {
-  name = "LunoraEnvError";
+class LunoraEnvError extends LunoraError$1 {
   failures;
   constructor(failures) {
     const summary = failures.map((failure) => `  - ${failure.key}: ${failure.message}`).join("\n");
-    super(`Invalid environment (${String(failures.length)} key(s)):
-${summary}`);
+    super("ENV_INVALID", `Invalid environment (${String(failures.length)} key(s)):
+${summary}`, { name: "LunoraEnvError" });
     this.failures = failures;
   }
 }

package/dist/packem_shared/LunoraError-WbxmrpxR.mjs

@@ -0,0 +1,9 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+class LunoraError extends LunoraError$1 {
+  constructor(code, message, data) {
+    super(code, message, { data });
+  }
+}
+
+export { LunoraError };

package/dist/packem_shared/{PRESENCE_DEFAULT_TTL_MS-BZYd5-uo.mjs → PRESENCE_DEFAULT_TTL_MS-BtPCiNLW.mjs}

@@ -1,9 +1,9 @@
 import { v } from '@lunora/values';
-import { initLunora } from './initLunora-CATvPsVt.mjs';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { initLunora } from './initLunora-sQUqaejx.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 import { onDisconnect } from './onConnect-CIPXKPyw.mjs';
-import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-Ck5_TUO8.mjs';
-import { defineTable } from './defineAggregateIndex-DxSso0rH.mjs';
+import { defineSchemaExtension, defineComponent } from './composePluginMiddleware-CcTj1_v2.mjs';
+import { defineTable } from './defineAggregateIndex-znq4ygKQ.mjs';
 
 const DEFAULT_TTL_MS = 3e4;
 const MAX_DATA_BYTES = 4096;

package/dist/packem_shared/bindOrm-Bfgl7f-Q.mjs

@@ -0,0 +1,146 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+const isUniqueConflict = (error) => typeof error === "object" && error !== null && error.code === "CONFLICT" && error.kind === "unique";
+const buildUpsertWhere = (tableName, target, create) => {
+  const fields = typeof target === "string" ? [target] : target;
+  if (fields.length === 0) {
+    throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: "target" must name at least one field`);
+  }
+  const where = {};
+  for (const field of fields) {
+    if (!(field in create)) {
+      throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.upsert: target field "${field}" is missing from the create document`);
+    }
+    where[field] = create[field];
+  }
+  return where;
+};
+const bindTableFacade = (writer, tableName) => {
+  const insert = async (document, options) => {
+    if (options?.skipDuplicates !== true) {
+      return writer.insert(tableName, document);
+    }
+    try {
+      return await writer.insert(tableName, document);
+    } catch (error) {
+      if (isUniqueConflict(error)) {
+        return null;
+      }
+      throw error;
+    }
+  };
+  const upsert = async ({ create, target, update }) => {
+    const where = buildUpsertWhere(tableName, target, create);
+    const existing = await writer.findFirst(tableName, { where });
+    if (existing && typeof existing["_id"] === "string") {
+      await writer.patch(existing["_id"], update ?? create, tableName);
+      return { created: false, id: existing["_id"] };
+    }
+    const id = await writer.insert(tableName, create);
+    return { created: true, id };
+  };
+  return {
+    aggregate: (options) => writer.aggregate(tableName, options),
+    count: (where) => writer.count(tableName, where),
+    delete: (id) => writer.delete(id, tableName),
+    // `deleteMany`/`patchMany` forward the bound `tableName` as `expectedTable`
+    // for id-based calls (threaded through the writer + the RLS middleware's
+    // per-id gate) so every batched id is scoped to this table — the same IDOR
+    // guard the single-row `delete`/`patch` apply. The where-based form routes
+    // through the structural writer's `deleteMany(tableName, { where })`.
+    // `patchMany` maps the facade's `values` payload to the writer's
+    // `{ id, patch }` shape.
+    deleteMany: (first, options) => {
+      if (Array.isArray(first)) {
+        if (writer.deleteMany === void 0) {
+          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany is unavailable: this writer has no batch delete`);
+        }
+        return writer.deleteMany(first, options, tableName);
+      }
+      if (writer.deleteWhere === void 0) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.deleteMany({ where }) is unavailable: this writer has no where-based delete`);
+      }
+      const whereArgs = first;
+      return writer.deleteWhere(tableName, whereArgs.where, { limit: whereArgs.limit });
+    },
+    // `exists` reuses `findFirst` (RLS-filtered, indexed when a `.withIndex`-able
+    // `where` is supplied) and only asks whether a row came back — no count scan.
+    exists: async (where) => await writer.findFirst(tableName, where === void 0 ? void 0 : { where }) !== null,
+    findFirst: (args) => writer.findFirst(tableName, args),
+    findFirstOrThrow: (args) => writer.findFirstOrThrow(tableName, args),
+    findMany: (args) => writer.findMany(tableName, args),
+    get: (id) => writer.get(id, tableName),
+    groupBy: (options) => writer.groupBy(tableName, options),
+    // Physical removal — bypasses `.softDelete()`. RLS gates it as a delete.
+    hardDelete: (id) => writer.delete(id, tableName, { hard: true }),
+    insert,
+    insertMany: (documents, options) => {
+      if (writer.insertMany === void 0) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.insertMany is unavailable: this writer has no batch insert`);
+      }
+      return writer.insertMany(tableName, documents, options);
+    },
+    patch: (id, patch) => writer.patch(id, patch, tableName),
+    patchMany: (first, options) => {
+      if (Array.isArray(first)) {
+        if (writer.patchMany === void 0) {
+          throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany is unavailable: this writer has no batch patch`);
+        }
+        return writer.patchMany(
+          first.map((entry) => {
+            return { id: entry.id, patch: entry.values };
+          }),
+          options,
+          tableName
+        );
+      }
+      if (writer.patchWhere === void 0) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.patchMany({ where, values }) is unavailable: this writer has no where-based patch`);
+      }
+      const whereArgs = first;
+      return writer.patchWhere(tableName, { patch: whereArgs.values, where: whereArgs.where }, { limit: whereArgs.limit });
+    },
+    rank: (indexName, options) => writer.rank(tableName, indexName, options),
+    rankPage: (indexName, options) => writer.rankPage(tableName, indexName, options),
+    replace: (id, document) => writer.replace(id, document, tableName),
+    restore: async (id) => {
+      if (!writer.restore) {
+        throw new LunoraError$1("INTERNAL", `ctx.db.${tableName}.restore is unavailable: this writer has no restore (is the table .softDelete()?)`);
+      }
+      await writer.restore(id, tableName);
+    },
+    upsert,
+    upsertMany: async ({ rows, target }) => {
+      const results = [];
+      for (const row of rows) {
+        results.push(await upsert({ create: row.create, target, update: row.update }));
+      }
+      return results;
+    },
+    withSearchIndex: (indexName, search) => writer.query(tableName).withSearchIndex(indexName, search)
+  };
+};
+const bindOrm = (facade) => {
+  const resolve = (table) => {
+    const bound = facade[table];
+    if (!bound) {
+      throw new LunoraError$1("INTERNAL", `unknown table: ${table}`);
+    }
+    return bound;
+  };
+  return {
+    delete: (table, id) => resolve(table).delete(id),
+    insert: (table) => {
+      return { values: (document) => resolve(table).insert(document) };
+    },
+    query: facade,
+    replace: (table, id) => {
+      return { with: (document) => resolve(table).replace(id, document) };
+    },
+    update: (table, id) => {
+      return { set: (values) => resolve(table).patch(id, values) };
+    }
+  };
+};
+
+export { bindOrm, bindTableFacade };

package/dist/packem_shared/buildRlsReadRegistry-D54vUQe4.mjs

@@ -0,0 +1,107 @@
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-B_ZWgslr.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+
+const FALSE_PREDICATE = { OR: [] };
+const readEntryTags = (entry) => {
+  const hoisted = entry?.rls?.tags;
+  if (hoisted) {
+    return hoisted;
+  }
+  const tag = readRlsTag(entry);
+  return tag ? [tag] : [];
+};
+const addTagToRegistry = (byTable, tag) => {
+  const rolePermissions = indexRolePermissions(tag.roles);
+  const seenWhenByTable = /* @__PURE__ */ new Map();
+  const policiesByTable = /* @__PURE__ */ new Map();
+  for (const policy of tag.policies) {
+    if (policy.on !== "read") {
+      continue;
+    }
+    const seen = seenWhenByTable.get(policy.table) ?? /* @__PURE__ */ new Set();
+    if (seen.has(policy.when)) {
+      continue;
+    }
+    seen.add(policy.when);
+    seenWhenByTable.set(policy.table, seen);
+    const list = policiesByTable.get(policy.table) ?? [];
+    list.push(policy);
+    policiesByTable.set(policy.table, list);
+  }
+  for (const [table, policies] of policiesByTable) {
+    const groups = byTable.get(table) ?? [];
+    groups.push({ policies, rolePermissions });
+    byTable.set(table, groups);
+  }
+};
+const isFalsePredicate = (where) => {
+  const or = where.OR;
+  return Array.isArray(or) && or.length === 0 && Object.keys(where).length === 1;
+};
+const andMerge = (injected, caller) => {
+  if (!injected || Object.keys(injected).length === 0) {
+    return caller;
+  }
+  if (isFalsePredicate(injected)) {
+    return injected;
+  }
+  if (Object.keys(caller).length === 0) {
+    return injected;
+  }
+  return { AND: [injected, caller] };
+};
+const evaluateGroupBaseWhere = (group, request) => {
+  const granted = /* @__PURE__ */ new Set();
+  for (const roleName of request.roles) {
+    for (const name of group.rolePermissions.get(roleName) ?? []) {
+      granted.add(name);
+    }
+  }
+  return computeReadBaseWhere(group.policies, {
+    auth: {
+      can: (permission) => granted.has(permissionName(permission)),
+      identity: request.identity,
+      roles: request.roles,
+      userId: request.userId
+    },
+    ctx: request.ctx
+  });
+};
+const resolveReadBaseWhere = (registry, request) => {
+  const groups = registry.byTable.get(request.table);
+  if (!groups || groups.length === 0) {
+    return request.rlsRequired && !request.tablePublic ? FALSE_PREDICATE : void 0;
+  }
+  const predicates = [];
+  for (const group of groups) {
+    const base = evaluateGroupBaseWhere(group, request);
+    if (base === void 0) {
+      return void 0;
+    }
+    if (isFalsePredicate(base)) {
+      continue;
+    }
+    predicates.push(base);
+  }
+  if (predicates.length === 0) {
+    return FALSE_PREDICATE;
+  }
+  return predicates.length === 1 ? predicates[0] : { OR: predicates };
+};
+const buildRlsReadRegistry = (functions) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const seenTags = /* @__PURE__ */ new Set();
+  for (const entry of functions) {
+    for (const tag of readEntryTags(entry)) {
+      if (seenTags.has(tag)) {
+        continue;
+      }
+      seenTags.add(tag);
+      addTagToRegistry(byTable, tag);
+    }
+  }
+  return { byTable };
+};
+const composeShapeReadWhere = (registry, request) => andMerge(resolveReadBaseWhere(registry, request), request.shapeWhere);
+
+export { buildRlsReadRegistry, composeShapeReadWhere };

package/dist/packem_shared/{composePluginMiddleware-Ck5_TUO8.mjs → composePluginMiddleware-CcTj1_v2.mjs}

@@ -1,4 +1,5 @@
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const prefixTableName = (key, bareName) => `${key}_${bareName}`;
 const rewriteReference = (target, key, bareNames) => bareNames.has(target) ? prefixTableName(key, target) : target;
@@ -19,7 +20,7 @@ const rewriteTableReferences = (table, key, bareNames, ownBareName) => {
 };
 const defineSchemaExtension = (key, options) => {
   if (!key) {
-    throw new Error("defineSchemaExtension: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineSchemaExtension: `key` is required and must be a non-empty string");
   }
   return {
     key,
@@ -29,10 +30,10 @@ const defineSchemaExtension = (key, options) => {
 };
 const definePlugin = (key, options) => {
   if (!key) {
-    throw new Error("definePlugin: `key` is required and must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "definePlugin: `key` is required and must be a non-empty string");
   }
   if (options.extension && options.extension.key !== key) {
-    throw new Error(`definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
+    throw new LunoraError$1("INTERNAL", `definePlugin("${key}"): extension key "${options.extension.key}" does not match plugin key`);
   }
   return {
     key,
@@ -57,7 +58,8 @@ const mergeSchemaExtension = (base, extension) => {
   for (const [bareName, table] of Object.entries(extension.tables)) {
     const prefixed = prefixTableName(key, bareName);
     if (Object.hasOwn(merged, prefixed)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineSchema(...).extend("${key}"): table "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
       );
     }
@@ -68,7 +70,8 @@ const mergeSchemaExtension = (base, extension) => {
     for (const [bareIndexName, index] of Object.entries(extension.vectorIndexes)) {
       const prefixed = prefixTableName(key, bareIndexName);
       if (Object.hasOwn(mergedVectorIndexes, prefixed)) {
-        throw new Error(
+        throw new LunoraError$1(
+          "INTERNAL",
           `defineSchema(...).extend("${key}"): vector index "${prefixed}" already exists in the base schema — another extension with the same key already contributed it`
         );
       }

package/dist/packem_shared/{createPolicyDsl-De67zPDS.mjs → createPolicyDsl-By3QB4he.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const definePolicy = (input) => {
   return { on: input.on, table: input.table, when: input.when };
 };
@@ -13,7 +15,8 @@ const definePolicies = (policies) => {
     const key = JSON.stringify([policy.table, policy.on]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(policy.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `definePolicies: duplicate policy for (table "${policy.table}", on "${policy.on}") — the same decision function is registered more than once. Multiple distinct policies per (table, on) are allowed (reads OR, writes AND); remove the duplicate.`
       );
     }

package/dist/packem_shared/createSecrets-DwaR2rNG.mjs

@@ -0,0 +1,58 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
+const NON_SECRET_BINDING_METHODS = [
+  "put",
+  // KV / R2
+  "list",
+  // KV / R2
+  "delete",
+  // KV / R2
+  "getWithMetadata",
+  // KV
+  "head",
+  // R2
+  "createMultipartUpload",
+  // R2
+  "idFromName",
+  // Durable Object namespace
+  "newUniqueId",
+  // Durable Object namespace
+  "getByName",
+  // Durable Object namespace
+  "send",
+  // Queue producer
+  "sendBatch",
+  // Queue producer
+  "writeDataPoint",
+  // Analytics Engine dataset
+  "create",
+  // Workflows binding (get(id) + create/createBatch)
+  "createBatch"
+  // Workflows binding
+];
+const isSecretBinding = (value) => {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value;
+  if (typeof record.get !== "function") {
+    return false;
+  }
+  return !NON_SECRET_BINDING_METHODS.some((method) => typeof record[method] === "function");
+};
+const createSecrets = (env) => {
+  return {
+    get: async (name) => {
+      const binding = env[name];
+      if (!isSecretBinding(binding)) {
+        throw new LunoraError$1(
+          "INTERNAL",
+          `ctx.secrets: no Secrets Store binding named "${name}". Add a \`secrets_store_secrets[]\` entry (binding "${name}", pointing at your store + secret) to wrangler.jsonc — \`ctx.secrets\` reads a Secrets Store binding, not a plain \`.dev.vars\` value.`
+        );
+      }
+      return binding.get();
+    }
+  };
+};
+
+export { createSecrets };

package/dist/packem_shared/{defineAggregateIndex-DxSso0rH.mjs → defineAggregateIndex-znq4ygKQ.mjs}

@@ -1,5 +1,6 @@
-import { isOrWrapsFromValidator } from '@lunora/values';
-import { mergeSchemaExtension } from './composePluginMiddleware-Ck5_TUO8.mjs';
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { isOrWrapsFromValidator, v } from '@lunora/values';
+import { mergeSchemaExtension } from './composePluginMiddleware-CcTj1_v2.mjs';
 
 const relationBuilder = {
   many: (table, options) => {
@@ -22,10 +23,11 @@ const createTriggerBuilder = () => {
     beforeUpdate: (handler) => makeTrigger("before", "update", handler)
   };
 };
-const defineTable = (shape) => {
+const defineTable = (inputShape) => {
+  const shape = { ...inputShape };
   for (const [columnName, validator] of Object.entries(shape)) {
     if (isOrWrapsFromValidator(validator)) {
-      throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
+      throw new LunoraError$1("INTERNAL", `defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
     }
   }
   const aggregateIndexes = [];
@@ -39,11 +41,13 @@ const defineTable = (shape) => {
   let shardMode = { kind: "root" };
   let isExternallyManaged = false;
   let isPublic = false;
+  let softDelete;
+  let externalSource;
   const builder = {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
       if (op !== "count" && !options?.field) {
-        throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+        throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
       }
       aggregateIndexes.push({
         by: options?.by,
@@ -61,6 +65,9 @@ const defineTable = (shape) => {
     get aggregateIndexes() {
       return aggregateIndexes;
     },
+    get externalSource() {
+      return externalSource;
+    },
     externallyManaged() {
       isExternallyManaged = true;
       return builder;
@@ -88,7 +95,7 @@ const defineTable = (shape) => {
     },
     rankIndex(name, options) {
       if (!options.sortBy || options.sortBy.length === 0) {
-        throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+        throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
       }
       const sortBy = options.sortBy.map((key) => {
         return {
@@ -132,6 +139,28 @@ const defineTable = (shape) => {
     get shardMode() {
       return shardMode;
     },
+    get softDeleteMode() {
+      return softDelete;
+    },
+    source(definition) {
+      if (!definition.binding) {
+        throw new LunoraError$1("INTERNAL", "source: `binding` is required (the wrangler Hyperdrive binding name)");
+      }
+      if (!definition.query) {
+        throw new LunoraError$1("INTERNAL", "source: `query` is required (the tenant-membership SQL)");
+      }
+      externalSource = definition;
+      isExternallyManaged = true;
+      return builder;
+    },
+    softDelete(options) {
+      const field = options?.field ?? "deletedAt";
+      softDelete = { field };
+      if (!(field in shape)) {
+        shape[field] = v.optional(v.number().nullable());
+      }
+      return builder;
+    },
     get triggerMap() {
       return triggers;
     },
@@ -170,13 +199,13 @@ const defineVectorIndex = (options) => {
 const defineAggregateIndex = (name, options) => {
   const op = options.op ?? "count";
   if (op !== "count" && !options.field) {
-    throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+    throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
   }
   return { by: options.by, field: options.field, name, on: options.on, op, where: options.where };
 };
 const defineRankIndex = (name, options) => {
   if (!options.sortBy || options.sortBy.length === 0) {
-    throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+    throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
   }
   const sortBy = options.sortBy.map((key) => {
     return {
@@ -192,6 +221,9 @@ const withExtend = (schema) => {
     extend(extension) {
       return withExtend(mergeSchemaExtension(schema, extension));
     },
+    jurisdiction(_jurisdiction) {
+      return withExtend(schema);
+    },
     rls(mode) {
       return withExtend({ ...schema, rlsMode: mode });
     }
@@ -215,21 +247,48 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
   for (const index of Object.values(aggregateIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.aggregateIndexes.push(index);
   }
   for (const index of Object.values(rankIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineRankIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineRankIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.rankIndexes.push(index);
   }
 };
+const validateExternalSources = (tables) => {
+  for (const [name, table] of Object.entries(tables)) {
+    const source = table.externalSource;
+    if (!source) {
+      continue;
+    }
+    if (table.shardMode.kind === "global") {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
+      );
+    }
+    if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
+      );
+    }
+    if (source.mode === "incremental") {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: table "${name}" uses \`mode: "incremental"\`, which is not yet implemented — only "full-pull" (the default) is supported. Remove \`mode\` or set it to "full-pull".`
+      );
+    }
+  }
+};
 const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
   fillIndexTableNames(tables);
   attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  validateExternalSources(tables);
   return withExtend({ tables, vectorIndexes });
 };
 

package/dist/packem_shared/defineIdentity-DiX4zM9x.mjs

@@ -0,0 +1,35 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { parseValidatorMap, ValidationError } from '@lunora/values';
+
+const NON_STRING_USER_ID_KINDS = /* @__PURE__ */ new Set([
+  "array",
+  "bigint",
+  "boolean",
+  "bytes",
+  "date",
+  "null",
+  "number",
+  "object",
+  "optional",
+  "record",
+  "timestamp"
+]);
+const defineIdentity = (claims, options = {}) => {
+  const map = claims;
+  const userIdValidator = map["userId"];
+  if (userIdValidator === void 0 || NON_STRING_USER_ID_KINDS.has(userIdValidator.kind)) {
+    throw new LunoraError$1("INTERNAL", "defineIdentity: the claim map must declare a required string `userId` validator (e.g. `v.string()` or `v.id(...)`)");
+  }
+  const onInvalid = options.onInvalid ?? "anonymous";
+  const validate = (identity) => {
+    try {
+      parseValidatorMap(map, identity, "identity");
+      return { ok: true };
+    } catch (error) {
+      return { error: error instanceof ValidationError ? error.message : String(error), ok: false };
+    }
+  };
+  return { __lunoraIdentity: true, claims: map, onInvalid, validate };
+};
+
+export { defineIdentity };