@lunora/vite 1.0.0-alpha.39 → 1.0.0-alpha.40

package/dist/index.d.mts

@@ -14,6 +14,15 @@ type CloudflarePluginOptions = Record<string, unknown>;
 */
 type OverlayPluginOptions = NonNullable<Parameters<typeof errorOverlayPlugin>[0]>;
 interface LunoraPluginOptions {
+  /**
+  * Allow a client-named NON-default shard / cross-shard fan-out WITHOUT an
+  * `authorizeShard`/`authorizeFanOut` callback. The auto-composed class-A worker
+  * (`virtual:lunora/worker`) default-denies such access (403 `FORBIDDEN_SHARD`);
+  * set this `true` to opt into open access — only safe when every table is
+  * protected by per-row RLS. A production sharded app should configure
+  * `authorizeShard` instead (via a hand-written class-B worker). Defaults to `false`.
+  */
+  allowUnauthenticatedShardAccess?: boolean;
   /**
   * Which machine-readable API spec(s) codegen emits into `_generated/`.
   * `"openapi"` (default) writes `openapi.json` (OpenAPI 3.1; RPC + REST),
@@ -43,6 +52,7 @@ interface LunoraPluginOptions {
 }
 /** Resolved options after merging defaults. */
 interface ResolvedLunoraPluginOptions {
+  allowUnauthenticatedShardAccess: boolean;
   apiSpec: NonNullable<CodegenOptions["apiSpec"]>;
   cloudflare: false | CloudflarePluginOptions;
   generatedDir: string;
@@ -222,7 +232,7 @@ declare const isAutoComposable: (context: LunoraPluginContext) => boolean;
 * virtual module id. Absolute paths are resolved correctly in all environments
 * (Vite 8 + rolldown 1.x confirmed).
 */
-declare const buildWorkerEntrySource: (framework: DetectedFramework, generatedImportBase: string, hasContainers?: boolean, useUmbrella?: boolean) => string;
+declare const buildWorkerEntrySource: (framework: DetectedFramework, generatedImportBase: string, hasContainers?: boolean, useUmbrella?: boolean, allowUnauthenticatedShardAccess?: boolean) => string;
 /**
 * Vite plugin that auto-composes a detected class-A meta-framework's SSR
 * handler with Lunora into one Cloudflare Worker (PLAN4 §2.4 / §3 class-A row).

package/dist/index.d.ts

@@ -14,6 +14,15 @@ type CloudflarePluginOptions = Record<string, unknown>;
 */
 type OverlayPluginOptions = NonNullable<Parameters<typeof errorOverlayPlugin>[0]>;
 interface LunoraPluginOptions {
+  /**
+  * Allow a client-named NON-default shard / cross-shard fan-out WITHOUT an
+  * `authorizeShard`/`authorizeFanOut` callback. The auto-composed class-A worker
+  * (`virtual:lunora/worker`) default-denies such access (403 `FORBIDDEN_SHARD`);
+  * set this `true` to opt into open access — only safe when every table is
+  * protected by per-row RLS. A production sharded app should configure
+  * `authorizeShard` instead (via a hand-written class-B worker). Defaults to `false`.
+  */
+  allowUnauthenticatedShardAccess?: boolean;
   /**
   * Which machine-readable API spec(s) codegen emits into `_generated/`.
   * `"openapi"` (default) writes `openapi.json` (OpenAPI 3.1; RPC + REST),
@@ -43,6 +52,7 @@ interface LunoraPluginOptions {
 }
 /** Resolved options after merging defaults. */
 interface ResolvedLunoraPluginOptions {
+  allowUnauthenticatedShardAccess: boolean;
   apiSpec: NonNullable<CodegenOptions["apiSpec"]>;
   cloudflare: false | CloudflarePluginOptions;
   generatedDir: string;
@@ -222,7 +232,7 @@ declare const isAutoComposable: (context: LunoraPluginContext) => boolean;
 * virtual module id. Absolute paths are resolved correctly in all environments
 * (Vite 8 + rolldown 1.x confirmed).
 */
-declare const buildWorkerEntrySource: (framework: DetectedFramework, generatedImportBase: string, hasContainers?: boolean, useUmbrella?: boolean) => string;
+declare const buildWorkerEntrySource: (framework: DetectedFramework, generatedImportBase: string, hasContainers?: boolean, useUmbrella?: boolean, allowUnauthenticatedShardAccess?: boolean) => string;
 /**
 * Vite plugin that auto-composes a detected class-A meta-framework's SSR
 * handler with Lunora into one Cloudflare Worker (PLAN4 §2.4 / §3 class-A row).

package/dist/index.mjs

@@ -8,8 +8,8 @@ import containerLogsPlugin from './packem_shared/containerLogsPlugin-DMssU3wb.mj
 import devVariablesPlugin from './packem_shared/devVariablesPlugin-CDNSnvOP.mjs';
 import { createCommandProbe, withDevWorkerEnv } from './packem_shared/DEV_WORKER_ENV_VALUE-Coo6bgVz.mjs';
 export { DEV_WORKER_ENV_VALUE, DEV_WORKER_ENV_VAR } from './packem_shared/DEV_WORKER_ENV_VALUE-Coo6bgVz.mjs';
-import { frameworkComposePlugin } from './packem_shared/CLASS_A_WIRING-DpX_WcOK.mjs';
-export { CLASS_A_WIRING, LUNORA_WORKER_VIRTUAL_ID, buildWorkerEntrySource, isAutoComposable } from './packem_shared/CLASS_A_WIRING-DpX_WcOK.mjs';
+import { frameworkComposePlugin } from './packem_shared/CLASS_A_WIRING-DWYL4g1x.mjs';
+export { CLASS_A_WIRING, LUNORA_WORKER_VIRTUAL_ID, buildWorkerEntrySource, isAutoComposable } from './packem_shared/CLASS_A_WIRING-DWYL4g1x.mjs';
 import logStreamPlugin from './packem_shared/logStreamPlugin-CqvZ17kd.mjs';
 import { planViteRemoteBindings, remoteBindingsCleanupPlugin, withRemoteBindings } from './packem_shared/planViteRemoteBindings-QN5ncUS1.mjs';
 import { lunoraSolutionFinders } from './packem_shared/lunoraSolutionFinder-BKEAiUJP.mjs';
@@ -109,6 +109,7 @@ const resolveOptions = (options) => {
     cloudflareOption = input.cloudflare;
   }
   return {
+    allowUnauthenticatedShardAccess: input.allowUnauthenticatedShardAccess ?? false,
     apiSpec: input.apiSpec ?? "openapi",
     cloudflare: cloudflareOption,
     studio: input.studio ?? true,

package/dist/packem_shared/{CLASS_A_WIRING-DpX_WcOK.mjs → CLASS_A_WIRING-DWYL4g1x.mjs}

@@ -47,7 +47,7 @@ const projectUsesUmbrella = (projectRoot) => {
     return false;
   }
 };
-const buildWorkerEntrySource = (framework, generatedImportBase, hasContainers = false, useUmbrella = false) => {
+const buildWorkerEntrySource = (framework, generatedImportBase, hasContainers = false, useUmbrella = false, allowUnauthenticatedShardAccess = false) => {
   const wiring = CLASS_A_WIRING[framework];
   if (wiring === void 0) {
     throw new Error(`[lunora] no class-A worker wiring for framework "${framework}"`);
@@ -72,7 +72,7 @@ let worker;
 
 export default {
     async fetch(request, env, context) {
-        worker ??= composeWorker({
+        worker ??= composeWorker({${allowUnauthenticatedShardAccess ? "\n            allowUnauthenticatedShardAccess: true," : ""}
             functions: LUNORA_FUNCTIONS,
             httpRouter: ${wiring.handler},
             openApiSpec,
@@ -95,7 +95,13 @@ const frameworkComposePlugin = (options, context) => {
           return CLIENT_WORKER_STUB;
         }
         const hasContainers = existsSync(join(generatedImportBase, "containers.ts"));
-        return buildWorkerEntrySource(context.framework.framework, generatedImportBase, hasContainers, useUmbrella);
+        return buildWorkerEntrySource(
+          context.framework.framework,
+          generatedImportBase,
+          hasContainers,
+          useUmbrella,
+          options.allowUnauthenticatedShardAccess
+        );
       }
       return void 0;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/vite",
-  "version": "1.0.0-alpha.39",
+  "version": "1.0.0-alpha.40",
   "description": "The Lunora Vite plugin: codegen, type sync, wrangler validation, and an error overlay over @cloudflare/vite-plugin",
   "keywords": [
     "cloudflare",
@@ -46,14 +46,14 @@
   },
   "dependencies": {
     "@cloudflare/vite-plugin": "1.42.3",
-    "@lunora/codegen": "1.0.0-alpha.24",
-    "@lunora/config": "1.0.0-alpha.39",
+    "@lunora/codegen": "1.0.0-alpha.25",
+    "@lunora/config": "1.0.0-alpha.40",
     "@visulima/vite-overlay": "2.0.0-alpha.35",
     "jsonc-parser": "^3.3.1",
     "ts-morph": "^28.0.0"
   },
   "peerDependencies": {
-    "@lunora/studio": "1.0.0-alpha.25",
+    "@lunora/studio": "1.0.0-alpha.26",
     "vite": "^8.1.0"
   },
   "peerDependenciesMeta": {