@lunora/server 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/packem_shared/{defineAggregateIndex-B20MIOmj.mjs → defineAggregateIndex-cdo0g-un.mjs}

@@ -1,5 +1,6 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
 import { isOrWrapsFromValidator, v } from '@lunora/values';
-import { mergeSchemaExtension } from './composePluginMiddleware-Ck5_TUO8.mjs';
+import { mergeSchemaExtension } from './composePluginMiddleware-z62dttBo.mjs';
 
 const relationBuilder = {
   many: (table, options) => {
@@ -26,10 +27,11 @@ const defineTable = (inputShape) => {
   const shape = { ...inputShape };
   for (const [columnName, validator] of Object.entries(shape)) {
     if (isOrWrapsFromValidator(validator)) {
-      throw new Error(`defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
+      throw new LunoraError$1("INTERNAL", `defineTable: column "${columnName}" uses v.from() which is args-only — table columns need a concrete v.* type`);
     }
   }
   const aggregateIndexes = [];
+  const geoIndexes = [];
   const indexes = [];
   const rankIndexes = [];
   const relations = {};
@@ -41,11 +43,13 @@ const defineTable = (inputShape) => {
   let isExternallyManaged = false;
   let isPublic = false;
   let softDelete;
+  let ttl;
+  let externalSource;
   const builder = {
     aggregateIndex(name, options) {
       const op = options?.op ?? "count";
       if (op !== "count" && !options?.field) {
-        throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+        throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
       }
       aggregateIndexes.push({
         by: options?.by,
@@ -63,10 +67,20 @@ const defineTable = (inputShape) => {
     get aggregateIndexes() {
       return aggregateIndexes;
     },
+    get externalSource() {
+      return externalSource;
+    },
     externallyManaged() {
       isExternallyManaged = true;
       return builder;
     },
+    geoIndex(name, options) {
+      geoIndexes.push({ field: options.field, name, precision: options.precision });
+      return builder;
+    },
+    get geoIndexes() {
+      return geoIndexes;
+    },
     global(options) {
       shardMode = { backend: options?.backend ?? "d1", kind: "global" };
       return builder;
@@ -90,7 +104,7 @@ const defineTable = (inputShape) => {
     },
     rankIndex(name, options) {
       if (!options.sortBy || options.sortBy.length === 0) {
-        throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+        throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
       }
       const sortBy = options.sortBy.map((key) => {
         return {
@@ -137,6 +151,17 @@ const defineTable = (inputShape) => {
     get softDeleteMode() {
       return softDelete;
     },
+    source(definition) {
+      if (!definition.binding) {
+        throw new LunoraError$1("INTERNAL", "source: `binding` is required (the wrangler Hyperdrive binding name)");
+      }
+      if (!definition.query) {
+        throw new LunoraError$1("INTERNAL", "source: `query` is required (the tenant-membership SQL)");
+      }
+      externalSource = definition;
+      isExternallyManaged = true;
+      return builder;
+    },
     softDelete(options) {
       const field = options?.field ?? "deletedAt";
       softDelete = { field };
@@ -152,6 +177,13 @@ const defineTable = (inputShape) => {
       Object.assign(triggers, build(triggerBuilder));
       return builder;
     },
+    ttl(field, options) {
+      ttl = { after: options?.after, field };
+      return builder;
+    },
+    get ttlPolicy() {
+      return ttl;
+    },
     get vectorIndexes() {
       return vectorIndexes;
     },
@@ -183,13 +215,13 @@ const defineVectorIndex = (options) => {
 const defineAggregateIndex = (name, options) => {
   const op = options.op ?? "count";
   if (op !== "count" && !options.field) {
-    throw new Error(`aggregateIndex "${name}": op "${op}" requires a "field"`);
+    throw new LunoraError$1("INTERNAL", `aggregateIndex "${name}": op "${op}" requires a "field"`);
   }
   return { by: options.by, field: options.field, name, on: options.on, op, where: options.where };
 };
 const defineRankIndex = (name, options) => {
   if (!options.sortBy || options.sortBy.length === 0) {
-    throw new Error(`rankIndex "${name}": "sortBy" is required and must list at least one key`);
+    throw new LunoraError$1("INTERNAL", `rankIndex "${name}": "sortBy" is required and must list at least one key`);
   }
   const sortBy = options.sortBy.map((key) => {
     return {
@@ -205,6 +237,9 @@ const withExtend = (schema) => {
     extend(extension) {
       return withExtend(mergeSchemaExtension(schema, extension));
     },
+    jurisdiction(_jurisdiction) {
+      return withExtend(schema);
+    },
     rls(mode) {
       return withExtend({ ...schema, rlsMode: mode });
     }
@@ -228,21 +263,86 @@ const attachStandaloneIndexes = (tables, aggregateIndexes, rankIndexes) => {
   for (const index of Object.values(aggregateIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineAggregateIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.aggregateIndexes.push(index);
   }
   for (const index of Object.values(rankIndexes)) {
     const table = tables[index.on];
     if (!table) {
-      throw new Error(`defineRankIndex "${index.name}": unknown table "${index.on}"`);
+      throw new LunoraError$1("INTERNAL", `defineRankIndex "${index.name}": unknown table "${index.on}"`);
     }
     table.rankIndexes.push(index);
   }
 };
+const strayIncrementalKnob = (source) => {
+  if (source.cursor) {
+    return "cursor";
+  }
+  if (source.reconcileEveryMs !== void 0) {
+    return "reconcileEveryMs";
+  }
+  if (source.softDeleteColumn !== void 0) {
+    return "softDeleteColumn";
+  }
+  return void 0;
+};
+const validateExternalSourceMode = (name, source) => {
+  const isIncremental = source.mode === "incremental";
+  if (source.mode !== void 0 && source.mode !== "full-pull" && !isIncremental) {
+    throw new LunoraError$1(
+      "INTERNAL",
+      `defineSchema: table "${name}" uses \`mode: ${JSON.stringify(source.mode)}\` — supported modes are "full-pull" (default) and "incremental".`
+    );
+  }
+  if (!isIncremental) {
+    const strayKnob = strayIncrementalKnob(source);
+    if (strayKnob) {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: table "${name}" sets \`${strayKnob}\` but is not \`mode: "incremental"\` — that knob only applies to incremental ingest. Set \`mode: "incremental"\` or remove \`${strayKnob}\`.`
+      );
+    }
+    return;
+  }
+  if (!source.cursor?.column || !source.cursor.query) {
+    throw new LunoraError$1(
+      "INTERNAL",
+      `defineSchema: table "${name}" is \`mode: "incremental"\` but has no \`cursor\` — add \`cursor: { column: "updated_at", query: "… WHERE … > $N" }\` binding the watermark as the trailing parameter.`
+    );
+  }
+  if (source.reconcileEveryMs === void 0 && source.softDeleteColumn === void 0) {
+    throw new LunoraError$1(
+      "INTERNAL",
+      `defineSchema: table "${name}" is \`mode: "incremental"\` with no delete-visibility path — an incremental pull never sees upstream deletes, so it would accumulate phantom rows. Add \`reconcileEveryMs\` (a periodic full-pull sweep) or \`softDeleteColumn\` (an upstream tombstone column).`
+    );
+  }
+};
+const validateExternalSources = (tables) => {
+  for (const [name, table] of Object.entries(tables)) {
+    const source = table.externalSource;
+    if (!source) {
+      continue;
+    }
+    if (table.shardMode.kind === "global") {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: table "${name}" cannot be both .source() and .global() — a sourced table materializes into a shard DO's SQLite, a global table lives in the external tier`
+      );
+    }
+    if (table.shardMode.kind === "shardBy" && !source.tenantBy) {
+      throw new LunoraError$1(
+        "INTERNAL",
+        `defineSchema: sourced + .shardBy() table "${name}" needs a \`tenantBy\` mapper — without it every tenant's DO would run the same unscoped query and replicate the whole multitenant table (a cross-tenant leak). Add \`tenantBy: (shardKey) => [shardKey]\` binding the shard key into the query's parameters.`
+      );
+    }
+    validateExternalSourceMode(name, source);
+  }
+};
 const defineSchema = (tables, vectorIndexes = {}, aggregateIndexes = {}, rankIndexes = {}) => {
   fillIndexTableNames(tables);
   attachStandaloneIndexes(tables, aggregateIndexes, rankIndexes);
+  validateExternalSources(tables);
   return withExtend({ tables, vectorIndexes });
 };
 

package/dist/packem_shared/defineIdentity-DiX4zM9x.mjs

@@ -0,0 +1,35 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { parseValidatorMap, ValidationError } from '@lunora/values';
+
+const NON_STRING_USER_ID_KINDS = /* @__PURE__ */ new Set([
+  "array",
+  "bigint",
+  "boolean",
+  "bytes",
+  "date",
+  "null",
+  "number",
+  "object",
+  "optional",
+  "record",
+  "timestamp"
+]);
+const defineIdentity = (claims, options = {}) => {
+  const map = claims;
+  const userIdValidator = map["userId"];
+  if (userIdValidator === void 0 || NON_STRING_USER_ID_KINDS.has(userIdValidator.kind)) {
+    throw new LunoraError$1("INTERNAL", "defineIdentity: the claim map must declare a required string `userId` validator (e.g. `v.string()` or `v.id(...)`)");
+  }
+  const onInvalid = options.onInvalid ?? "anonymous";
+  const validate = (identity) => {
+    try {
+      parseValidatorMap(map, identity, "identity");
+      return { ok: true };
+    } catch (error) {
+      return { error: error instanceof ValidationError ? error.message : String(error), ok: false };
+    }
+  };
+  return { __lunoraIdentity: true, claims: map, onInvalid, validate };
+};
+
+export { defineIdentity };

package/dist/packem_shared/{defineMigration-CAJLr6fx.mjs → defineMigration-Hx01yIht.mjs}

@@ -1,6 +1,8 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineMigration = (definition) => {
   if (definition.id.trim() === "") {
-    throw new Error("defineMigration: `id` must be a non-empty string");
+    throw new LunoraError$1("INTERNAL", "defineMigration: `id` must be a non-empty string");
   }
   return { __lunoraMigration: true, ...definition };
 };

package/dist/packem_shared/defineMutator-EIXAWhs9.mjs

@@ -0,0 +1,11 @@
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineMutator = (definition) => {
+  const handler = async (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.server(context, parsed);
+  };
+  return { __lunoraMutator: true, ...definition, handler, kind: "mutation" };
+};
+
+export { defineMutator };

package/dist/packem_shared/defineShape-C5scNOrf.mjs

@@ -0,0 +1,18 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+
+const defineShape = (definition) => {
+  if (definition.table.trim() === "") {
+    throw new LunoraError$1("INTERNAL", "defineShape: `table` must be a non-empty string");
+  }
+  if (definition.columns?.length === 0) {
+    throw new LunoraError$1("INTERNAL", "defineShape: `columns` must list at least one column when provided");
+  }
+  const compileWhere = (context, rawArgs) => {
+    const parsed = validateArgs(definition.args ?? {}, rawArgs);
+    return definition.where(context, parsed);
+  };
+  return { __lunoraShape: true, ...definition, compileWhere };
+};
+
+export { defineShape };

package/dist/packem_shared/{defineStorageRule-qu0mpilX.mjs → defineStorageRule-B5nL4Z1P.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError as LunoraError$1 } from '@lunora/errors';
+
 const defineStorageRule = (input) => {
   return { bucket: input.bucket, on: input.on, prefix: input.prefix, when: input.when };
 };
@@ -7,7 +9,8 @@ const defineStorageRules = (rules) => {
     const key = JSON.stringify([rule.bucket, rule.on, rule.prefix]);
     const whens = seenWhenByKey.get(key) ?? /* @__PURE__ */ new Set();
     if (whens.has(rule.when)) {
-      throw new Error(
+      throw new LunoraError$1(
+        "INTERNAL",
         `defineStorageRules: duplicate rule for (bucket "${rule.bucket}", on "${rule.on}"${rule.prefix === void 0 ? "" : `, prefix "${rule.prefix}"`}) — the same decision function is registered more than once. Multiple distinct rules per (bucket, on) are allowed (they OR); remove the duplicate.`
       );
     }

package/dist/packem_shared/functions-Di9FUNkf.mjs

@@ -0,0 +1,5 @@
+import { parseValidatorMap } from '@lunora/values';
+
+const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+
+export { validateArgs as v };

package/dist/packem_shared/{httpAction-B7FYUEgr.mjs → httpAction-DCXoYPIk.mjs}

@@ -1,6 +1,7 @@
+import { toErrorBody } from '@lunora/errors';
 import { parseValidatorMap, ValidationError } from '@lunora/values';
 import { Hono } from 'hono';
-import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { LunoraError } from './LunoraError-WbxmrpxR.mjs';
 
 const httpAction = (handler) => async (c) => handler(c.get("lunora"), c.req.raw);
 const httpRouter = () => {
@@ -109,7 +110,11 @@ const errorResponse = (error) => {
     return Response.json({ code: "BAD_REQUEST", error: error.message }, { status: 400 });
   }
   if (error instanceof LunoraError) {
-    return Response.json({ code: error.code, error: error.message }, { status: error.status });
+    const { body, redacted, status } = toErrorBody(error, { fallbackCode: "INTERNAL_SERVER_ERROR", redactedMessage: "Internal error" });
+    if (redacted) {
+      console.error("[lunora] http action error (redacted on the wire):", error);
+    }
+    return Response.json({ code: body.code, error: body.message }, { status });
   }
   throw error;
 };
@@ -121,18 +126,25 @@ const buildRouteHandler = (state, userHandler) => async (c) => {
     const body = Object.keys(state.body).length > 0 ? await parseBody(state.body, c) : {};
     const result = await userHandler({ body, ctx: context, params, searchParams });
     const payload = state.output ? applyOutput(state.output, result) : result;
-    return payload === void 0 ? new Response(null, { status: 204 }) : Response.json(payload);
+    const headers = {};
+    if (state.cacheControl) {
+      headers["cache-control"] = state.cacheControl;
+    }
+    if (state.cacheTag) {
+      headers["cache-tag"] = state.cacheTag;
+    }
+    if (state.vary) {
+      headers.vary = state.vary;
+    }
+    const hasCacheHeaders = Object.keys(headers).length > 0;
+    if (payload === void 0) {
+      return new Response(null, { headers: hasCacheHeaders ? headers : void 0, status: 204 });
+    }
+    return Response.json(payload, { headers: hasCacheHeaders ? headers : void 0 });
   } catch (error) {
     return errorResponse(error);
   }
 };
-const isLunoraErrorLike = (error) => {
-  if (!error || typeof error !== "object") {
-    return false;
-  }
-  const candidate = error;
-  return candidate.name === "LunoraError" && typeof candidate.code === "string" && typeof candidate.message === "string";
-};
 const sseFrame = (chunk, event) => {
   const data = JSON.stringify(chunk);
   const prefix = event ? `event: ${event}
@@ -193,39 +205,42 @@ const buildStreamHandler = (state, userHandler) => (
           }
           controller.enqueue(encoder.encode(sseFrame({}, "complete")));
         } catch (error) {
-          let payload;
-          if (isLunoraErrorLike(error)) {
-            payload = { code: error.code, message: error.message };
-          } else {
+          const { body, redacted } = toErrorBody(error, { fallbackCode: "INTERNAL_SERVER_ERROR", redactedMessage: "Internal error" });
+          if (redacted) {
             console.error("[lunora] unhandled stream handler error:", error);
-            payload = { code: "INTERNAL_SERVER_ERROR", message: "Internal error" };
           }
-          controller.enqueue(encoder.encode(sseFrame(payload, "error")));
+          controller.enqueue(encoder.encode(sseFrame({ code: body.code, message: body.message }, "error")));
         } finally {
           request.signal.removeEventListener("abort", onAbort);
           controller.close();
         }
       }
     });
-    return new Response(stream, {
-      headers: {
-        "cache-control": "no-cache, no-transform",
-        "content-type": "text/event-stream; charset=utf-8",
-        // Hint to proxies (including Cloudflare's own buffering layer)
-        // that this response must not be coalesced.
-        "x-accel-buffering": "no"
-      }
-    });
+    const headers = {
+      // SSE responses must stay uncacheable so proxies don't buffer or
+      // coalesce live frames. `cacheControl()` is intentionally ignored
+      // for stream() routes; `cacheTag`/`vary` are also omitted because
+      // they only make sense alongside a cacheable response.
+      "cache-control": "no-cache, no-transform",
+      "content-type": "text/event-stream; charset=utf-8",
+      // Hint to proxies (including Cloudflare's own buffering layer)
+      // that this response must not be coalesced.
+      "x-accel-buffering": "no"
+    };
+    return new Response(stream, { headers });
   }
 );
 const makeRouteBuilder = (state) => {
   return {
     body: (validators) => makeRouteBuilder({ ...state, body: { ...state.body, ...validators } }),
+    cacheControl: (value) => makeRouteBuilder({ ...state, cacheControl: value }),
+    cacheTag: (value) => makeRouteBuilder({ ...state, cacheTag: value }),
     handler: (userHandler) => buildRouteHandler(state, userHandler),
     output: (validator) => makeRouteBuilder({ ...state, output: validator }),
     params: (validators) => makeRouteBuilder({ ...state, params: { ...state.params, ...validators } }),
     searchParams: (validators) => makeRouteBuilder({ ...state, searchParams: { ...state.searchParams, ...validators } }),
-    stream: (userHandler) => buildStreamHandler(state, userHandler)
+    stream: (userHandler) => buildStreamHandler(state, userHandler),
+    vary: (value) => makeRouteBuilder({ ...state, vary: value })
   };
 };
 const makeRouteFactory = (method) => (path) => makeRouteBuilder({ body: {}, method, params: {}, path, searchParams: {} });
@@ -337,4 +352,4 @@ const serveStorageObject = async (context, key, request) => {
   });
 };
 
-export { httpAction, httpRoute, httpRouter, serveStorageObject };
+export { httpAction, httpRoute, httpRouter, isSafeHeaderValue, serveStorageObject };

package/dist/packem_shared/{initLunora-CATvPsVt.mjs → initLunora-D0Wuki7S.mjs}

@@ -1,7 +1,6 @@
-import { parseValidatorMap } from '@lunora/values';
-import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
-
-const validateArgs = (validators, args) => parseValidatorMap(validators, args, "args");
+import { v as validateArgs } from './functions-Di9FUNkf.mjs';
+import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
+import { r as runMiddlewareChain } from './run-middleware-I6EiQfxL.mjs';
 
 const runMiddleware = (middlewares, baseContext) => runMiddlewareChain(middlewares, baseContext, (context) => context);
 const makeHandler = (args, middlewares, userHandler, output) => async (context, rawArgs) => {
@@ -35,17 +34,32 @@ const makeStreamHandler = (args, middlewares, userHandler) => (context, rawArgs,
     }
   })();
 };
+const collectRls = (middlewares) => {
+  const tags = [];
+  for (const middleware of middlewares) {
+    const tag = readRlsTag(middleware);
+    if (!tag) {
+      continue;
+    }
+    tags.push(tag);
+  }
+  return tags.length > 0 ? { tags } : void 0;
+};
 const makeBuilder = (kind, state, visibility) => {
   return {
     __lunoraProcedure: kind,
     ...visibility ? { __lunoraVisibility: visibility } : {},
     input: (validators) => makeBuilder(kind, { ...state, args: { ...state.args, ...validators } }, visibility),
     [kind]: (userHandler) => {
+      const rls = collectRls(state.middlewares);
       return {
         args: state.args,
+        ...state.expose ? { expose: state.expose } : {},
         handler: makeHandler(state.args, state.middlewares, userHandler, state.output),
         kind,
-        ...visibility ? { visibility } : {}
+        ...rls ? { rls } : {},
+        ...visibility ? { visibility } : {},
+        ...state.x402 ? { x402: state.x402 } : {}
       };
     },
     output: (validator) => makeBuilder(kind, { ...state, output: validator }, visibility),
@@ -55,15 +69,30 @@ const makeBuilder = (kind, state, visibility) => {
     // unconditionally keeps the runtime free of per-kind branching.
     ...kind === "query" ? {
       stream: (userHandler) => {
+        const rls = collectRls(state.middlewares);
         return {
           args: state.args,
+          ...state.expose ? { expose: state.expose } : {},
           handler: makeStreamHandler(state.args, state.middlewares, userHandler),
           kind: "stream",
-          ...visibility ? { visibility } : {}
+          ...rls ? { rls } : {},
+          ...visibility ? { visibility } : {},
+          ...state.x402 ? { x402: state.x402 } : {}
         };
       }
     } : {},
-    use: (middleware) => makeBuilder(kind, { ...state, middlewares: [...state.middlewares, middleware] }, visibility)
+    use: (middleware) => makeBuilder(kind, { ...state, middlewares: [...state.middlewares, middleware] }, visibility),
+    // `.expose({ rest: true })` publishes a PUBLIC procedure on the REST surface
+    // (plan 167). Public-only for the same reason as `.x402`: an internal
+    // function is server-to-server and never reachable over HTTP, so there is
+    // nothing to expose. Default-closed — omitting the modifier keeps the
+    // procedure RPC-only.
+    ...visibility ? {} : { expose: (config) => makeBuilder(kind, { ...state, expose: config }, visibility) },
+    // `.x402({ price })` marks a public procedure as paid. It's public-only:
+    // internal functions are server-to-server (cron/scheduler/`ctx.run*`) and
+    // never reachable via a client RPC, so there's nothing to charge. Omitting
+    // it on internal builders keeps the runtime shape aligned with the types.
+    ...visibility ? {} : { x402: (config) => makeBuilder(kind, { ...state, x402: config }, visibility) }
   };
 };
 const initLunora = {