@newhomestar/sdk 0.4.6 → 0.4.7

package/dist/index.d.ts

@@ -1,9 +1,18 @@
-import { z, ZodTypeAny } from "zod";
+import { z, type ZodTypeAny } from "zod";
+import type { IncomingMessage, ServerResponse } from "node:http";
 export interface ActionDef<I extends ZodTypeAny, O extends ZodTypeAny> {
     name: string;
     input: I;
     output: O;
     handler: (input: z.infer<I>, ctx: ActionCtx) => Promise<z.infer<O>>;
+    fga?: {
+        resourceType: string;
+        relation: string;
+        resourceIdKey?: string;
+        policy?: string;
+    };
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    path?: string;
 }
 export interface ActionCtx {
     jobId: string;
@@ -13,28 +22,71 @@ export declare function action<I extends ZodTypeAny, O extends ZodTypeAny>(cfg:
     name?: string;
     input: I;
     output: O;
+    fga?: {
+        resourceType: string;
+        relation: string;
+        resourceIdKey?: string;
+        policy?: string;
+    };
+    method?: 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+    path?: string;
     handler: (input: z.infer<I>, ctx: ActionCtx) => Promise<z.infer<O>>;
 }): ActionDef<I, O>;
-export interface WorkerDef {
-    name: string;
-    queue: string;
-    actions: Record<string, ActionDef<any, any>>;
-    envSpec?: {
-        name: string;
-        secret: boolean;
-        default?: string;
-    }[];
-}
+import type { NovaSpec } from './parseSpec.js';
+/**
+ * FGA policy hints embedded in nova.yaml
+ */
+export type FgaSpec = NovaSpec['fga'];
+import { type WorkerDef } from './workerSchema.js';
+/**
+ * Register a worker definition - SAME API as before
+ */
 export declare function defineWorker<T extends WorkerDef>(def: T): T;
 /** Enqueue an async action and receive `{ job_id }` */
 export declare function enqueue<P extends object>(actionPath: `${string}.${string}`, payload: P): Promise<{
     job_id: string;
 }>;
+/**
+ * Create an oRPC router from a WorkerDef, mapping each action to an oRPC procedure
+ */
+export declare function createORPCRouter<T extends WorkerDef>(def: T): Record<string, any>;
+export interface ORPCServerOptions {
+    port?: number;
+    plugins?: any[];
+}
+/**
+ * Run an official oRPC server - fully compliant with oRPC standards!
+ */
+export declare function runORPCServer<T extends WorkerDef>(def: T, options?: ORPCServerOptions): import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
 export declare function runWorker(def: WorkerDef): Promise<void>;
-export type { ZodTypeAny as SchemaAny, ZodTypeAny };
+export declare function generateOpenAPISpec<T extends WorkerDef>(def: T): Promise<{
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+        description: string;
+    };
+    paths: any;
+}>;
 /**
- * Spin up an HTTP server exposing each action under POST /<worker>/<action>
+ * Enhanced HTTP server exposing each action under configurable routes
  */
-export declare function runHttpServer(def: WorkerDef, opts?: {
+export declare function runHttpServer<T extends WorkerDef>(def: T, opts?: {
     port?: number;
 }): void;
+export type { ZodTypeAny as SchemaAny, ZodTypeAny };
+export { parseNovaSpec } from "./parseSpec.js";
+export type { NovaSpec } from "./parseSpec.js";
+import { parseNovaSpec as parseNovaSpecFunction } from "./parseSpec.js";
+declare const _default: {
+    defineWorker: typeof defineWorker;
+    action: typeof action;
+    enqueue: typeof enqueue;
+    runHttpServer: typeof runHttpServer;
+    runORPCServer: typeof runORPCServer;
+    runWorker: typeof runWorker;
+    generateOpenAPISpec: typeof generateOpenAPISpec;
+    createORPCRouter: typeof createORPCRouter;
+    parseNovaSpec: typeof parseNovaSpecFunction;
+};
+export default _default;

package/dist/index.js

@@ -1,37 +1,44 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.action = action;
-exports.defineWorker = defineWorker;
-exports.enqueue = enqueue;
-exports.runWorker = runWorker;
-exports.runHttpServer = runHttpServer;
-const dotenv_1 = __importDefault(require("dotenv"));
-const supabase_js_1 = require("@supabase/supabase-js");
+import dotenv from "dotenv";
+import { createClient } from "@supabase/supabase-js";
+import { OpenFgaClient } from "@openfga/sdk";
+import { createServer } from "node:http";
+// Full oRPC imports now working with ESM
+import { os } from "@orpc/server";
+import { RPCHandler } from "@orpc/server/node";
+import { CORSPlugin } from "@orpc/server/plugins";
 if (!process.env.RUNTIME_SUPABASE_URL) {
     // local dev – read .env.local
-    dotenv_1.default.config({ path: ".env.local", override: true });
+    dotenv.config({ path: ".env.local", override: true });
 }
-function action(cfg) {
-    return { name: cfg.name ?? "unnamed", ...cfg };
+export function action(cfg) {
+    return {
+        name: cfg.name ?? "unnamed",
+        method: cfg.method ?? 'POST',
+        path: cfg.path,
+        ...cfg
+    };
 }
-function defineWorker(def) {
-    return def; // identity – type info retained for CLI
+// WorkerDef represents the code-level definition passed into defineWorker()
+import { WorkerDefSchema } from './workerSchema.js';
+/**
+ * Register a worker definition - SAME API as before
+ */
+export function defineWorker(def) {
+    // Runtime validation of the worker definition
+    WorkerDefSchema.parse(def);
+    return def;
 }
-/*──────────────────────*  Client‑side enqueue()  *──────────────────*/
-// CLIENT_SUPABASE_… vars exist in gateways / other services
+/*──────────────────────*  Client‑side enqueue() (UNCHANGED)  *──────────────────*/
 const CLIENT_SUPABASE_URL = process.env.CLIENT_SUPABASE_PUBLIC_URL;
 const CLIENT_SUPABASE_KEY = process.env.CLIENT_SUPABASE_SERVICE_ROLE_KEY;
 let clientSupabase;
 function getClient() {
     if (!CLIENT_SUPABASE_URL || !CLIENT_SUPABASE_KEY)
         throw new Error("CLIENT_SUPABASE_* env vars not set");
-    return (clientSupabase ?? (clientSupabase = (0, supabase_js_1.createClient)(CLIENT_SUPABASE_URL, CLIENT_SUPABASE_KEY)));
+    return (clientSupabase ??= createClient(CLIENT_SUPABASE_URL, CLIENT_SUPABASE_KEY));
 }
 /** Enqueue an async action and receive `{ job_id }` */
-async function enqueue(actionPath, payload) {
+export async function enqueue(actionPath, payload) {
     const [pipeline, action] = actionPath.split(".");
     const { data, error } = await getClient().rpc("nova_enqueue", {
         pipeline_name: pipeline,
@@ -42,13 +49,70 @@ async function enqueue(actionPath, payload) {
         throw error;
     return data;
 }
-/*──────────────── Runtime harness (Supabase RPC) ───────────────*/
+/*──────────────── Full oRPC Integration (NOW WORKING!) ───────────────*/
+/**
+ * Create an oRPC router from a WorkerDef, mapping each action to an oRPC procedure
+ */
+export function createORPCRouter(def) {
+    const procedures = {};
+    for (const [actionName, actionDef] of Object.entries(def.actions)) {
+        // Create oRPC procedure - convert Nova action to oRPC procedure
+        const procedure = os
+            .input(actionDef.input)
+            .output(actionDef.output)
+            .handler(async ({ input, context }) => {
+            const ctx = {
+                jobId: context?.jobId || `orpc-${Date.now()}`,
+                progress: (percent, meta) => {
+                    console.log(`[${actionName}] Progress: ${percent}%`, meta);
+                }
+            };
+            return await actionDef.handler(input, ctx);
+        })
+            .callable(); // Make the procedure callable like a regular function
+        procedures[actionName] = procedure;
+    }
+    return procedures;
+}
+/**
+ * Run an official oRPC server - fully compliant with oRPC standards!
+ */
+export function runORPCServer(def, options = {}) {
+    const router = createORPCRouter(def);
+    console.log(`[nova] Starting official oRPC server "${def.name}"`);
+    // Use official oRPC serving pattern
+    const handler = new RPCHandler(router, {
+        plugins: [new CORSPlugin(), ...(options.plugins || [])]
+    });
+    const server = createServer(async (req, res) => {
+        const result = await handler.handle(req, res, {
+            context: {
+                headers: req.headers,
+                jobId: `orpc-${Date.now()}`,
+                // Add any other Nova-specific context
+            }
+        });
+        if (!result.matched) {
+            res.statusCode = 404;
+            res.end('No procedure matched');
+        }
+    });
+    const port = options.port ?? (process.env.PORT ? parseInt(process.env.PORT) : 8000);
+    server.listen(port, () => {
+        console.log(`[nova] Official oRPC server listening on http://localhost:${port}`);
+        console.log(`[nova] Available procedures: ${Object.keys(def.actions).join(', ')}`);
+        console.log(`[nova] 🔥 RPC protocol: ACTIVE (not HTTP fallback)`);
+        console.log(`[nova] 🌐 CORS: Enabled via CORSPlugin`);
+    });
+    return server;
+}
+/*──────────────── Runtime harness (Supabase RPC) - UNCHANGED ───────────────*/
 const RUNTIME_SUPABASE_URL = process.env.RUNTIME_SUPABASE_URL;
 const RUNTIME_SUPABASE_KEY = process.env.RUNTIME_SUPABASE_SERVICE_ROLE_KEY;
 const runtime = RUNTIME_SUPABASE_URL && RUNTIME_SUPABASE_KEY
-    ? (0, supabase_js_1.createClient)(RUNTIME_SUPABASE_URL, RUNTIME_SUPABASE_KEY)
+    ? createClient(RUNTIME_SUPABASE_URL, RUNTIME_SUPABASE_KEY)
     : undefined;
-async function runWorker(def) {
+export async function runWorker(def) {
     if (!runtime)
         throw new Error("RUNTIME_SUPABASE_* env vars not configured");
     console.log(`[nova] worker '${def.name}' polling ${def.queue}`);
@@ -77,6 +141,47 @@ async function runWorker(def) {
                 await nack(msg.msg_id, def.queue);
                 continue;
             }
+            // FGA enforcement (unchanged from original)
+            const hints = act.fga ? (Array.isArray(act.fga) ? act.fga : [act.fga]) : [];
+            if (hints.length) {
+                const apiEndpoint = process.env.OPENFGA_API_ENDPOINT;
+                const storeId = process.env.OPENFGA_STORE_ID;
+                const authToken = process.env.OPENFGA_AUTH_TOKEN;
+                if (!apiEndpoint || !storeId || !authToken) {
+                    throw new Error('Missing OPENFGA_API_ENDPOINT, OPENFGA_STORE_ID, or OPENFGA_AUTH_TOKEN for FGA enforcement');
+                }
+                const fgaClient = new OpenFgaClient({ apiUrl: apiEndpoint, storeId });
+                let authorized = true;
+                for (const hint of hints) {
+                    const key = hint.resourceIdKey;
+                    if (!key) {
+                        throw new Error(`Missing resourceIdKey for FGA hint on action '${actName}'`);
+                    }
+                    const id = payload[key];
+                    if (!id) {
+                        throw new Error(`Payload field '${key}' required for FGA hint on action '${actName}'`);
+                    }
+                    const tupleKey = {
+                        user: `user:${user_id}`,
+                        relation: hint.relation,
+                        object: `${hint.resourceType}:${id}`
+                    };
+                    const result = await fgaClient.check({
+                        user: tupleKey.user,
+                        relation: tupleKey.relation,
+                        object: tupleKey.object
+                    });
+                    if (!result.allowed) {
+                        authorized = false;
+                        break;
+                    }
+                }
+                if (!authorized) {
+                    await runtime.from("jobs").update({ status: "failed", error: "Unauthorized" }).eq("id", jobId);
+                    await ack(msg.msg_id, def.queue);
+                    continue;
+                }
+            }
             try {
                 const parsedInput = act.input.parse(payload);
                 const ctx = {
@@ -103,20 +208,64 @@ async function nack(id, q) {
     await runtime.schema("pgmq_public").rpc("nack", { queue_name: q, message_id: id });
 }
 function delay(ms) { return new Promise(r => setTimeout(r, ms)); }
-//──────────────────── HTTP Server Harness ─────────────────────
-const express_1 = __importDefault(require("express"));
-const body_parser_1 = __importDefault(require("body-parser"));
+/*──────────────── NEW: OpenAPI Spec Generation ───────────────*/
+export async function generateOpenAPISpec(def) {
+    // This would use oRPC's built-in OpenAPI generation
+    // For now, return a basic spec structure
+    return {
+        openapi: "3.0.0",
+        info: {
+            title: `${def.name} API`,
+            version: "1.0.0",
+            description: `OpenAPI specification for Nova worker: ${def.name}`
+        },
+        paths: Object.entries(def.actions).reduce((paths, [actionName, actionDef]) => {
+            const method = (actionDef.method || 'POST').toLowerCase();
+            const path = actionDef.path || `/${actionName}`;
+            paths[path] = {
+                [method]: {
+                    operationId: actionName,
+                    summary: `Execute ${actionName} action`,
+                    requestBody: {
+                        content: {
+                            'application/json': {
+                                schema: { type: 'object' } // Would be generated from Zod schema
+                            }
+                        }
+                    },
+                    responses: {
+                        '200': {
+                            description: 'Success',
+                            content: {
+                                'application/json': {
+                                    schema: { type: 'object' } // Would be generated from Zod schema
+                                }
+                            }
+                        }
+                    }
+                }
+            };
+            return paths;
+        }, {})
+    };
+}
+/*──────────────── HTTP Server Harness (Enhanced) ───────────────*/
+import express from "express";
+import bodyParser from "body-parser";
 /**
- * Spin up an HTTP server exposing each action under POST /<worker>/<action>
+ * Enhanced HTTP server exposing each action under configurable routes
  */
-function runHttpServer(def, opts = {}) {
-    const app = (0, express_1.default)();
-    app.use(body_parser_1.default.json());
+export function runHttpServer(def, opts = {}) {
+    const app = express();
+    app.use(bodyParser.json());
     for (const [actionName, act] of Object.entries(def.actions)) {
-        const route = `/${def.name}/${actionName}`;
-        app.post(route, async (req, res) => {
+        const method = (act.method || 'POST').toLowerCase();
+        const route = act.path || `/${def.name}/${actionName}`;
+        // unified handler: parse JSON body or default to empty object
+        const handler = async (req, res) => {
             try {
-                const input = act.input.parse(req.body);
+                const payload = req.body && typeof req.body === 'object' ? req.body : {};
+                const input = act.input.parse(payload);
                 const ctx = { jobId: `http-${Date.now()}`, progress: () => { } };
                 const out = await act.handler(input, ctx);
                 act.output.parse(out);
@@ -125,10 +274,36 @@ function runHttpServer(def, opts = {}) {
             catch (err) {
                 res.status(400).json({ error: err.message });
             }
-        });
+        };
+        // Register route with specified HTTP method
+        app[method](route, handler);
+        // Special case: expose health checks under GET /health for liveness checks
+        if (actionName === 'health' && method !== 'get') {
+            app.get('/health', handler);
+        }
     }
-    const port = opts.port ?? (process.env.PORT ? parseInt(process.env.PORT) : 3000);
+    const port = opts.port ?? (process.env.PORT ? parseInt(process.env.PORT) : 8000);
     app.listen(port, () => {
         console.log(`[nova] HTTP server listening on http://localhost:${port}`);
+        Object.entries(def.actions).forEach(([actionName, actionDef]) => {
+            const method = (actionDef.method || 'POST').toUpperCase();
+            const path = actionDef.path || `/${def.name}/${actionName}`;
+            console.log(`[nova] ${method} ${path} -> ${actionName}`);
+        });
     });
 }
+// YAML spec parsing utility
+export { parseNovaSpec } from "./parseSpec.js";
+// Default export for compatibility
+import { parseNovaSpec as parseNovaSpecFunction } from "./parseSpec.js";
+export default {
+    defineWorker,
+    action,
+    enqueue,
+    runHttpServer,
+    runORPCServer,
+    runWorker,
+    generateOpenAPISpec,
+    createORPCRouter,
+    parseNovaSpec: parseNovaSpecFunction
+};

package/dist/parseSpec.d.ts

@@ -0,0 +1,76 @@
+import { z } from "zod";
+export declare const NovaSpecSchema: z.ZodObject<{
+    apiVersion: z.ZodString;
+    kind: z.ZodString;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    spec: z.ZodObject<{
+        runtime: z.ZodObject<{
+            type: z.ZodString;
+            image: z.ZodString;
+            resources: z.ZodObject<{
+                cpu: z.ZodString;
+                memory: z.ZodString;
+            }, z.core.$strip>;
+            command: z.ZodArray<z.ZodString>;
+            queue: z.ZodString;
+            port: z.ZodNumber;
+            envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodOptional<z.ZodString>;
+                secret: z.ZodOptional<z.ZodBoolean>;
+                default: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>;
+        actions: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+            async: z.ZodOptional<z.ZodBoolean>;
+            input: z.ZodOptional<z.ZodUnknown>;
+            output: z.ZodOptional<z.ZodUnknown>;
+            schema: z.ZodOptional<z.ZodObject<{
+                input: z.ZodString;
+                output: z.ZodString;
+            }, z.core.$strip>>;
+            fga: z.ZodOptional<z.ZodObject<{
+                resourceType: z.ZodString;
+                relation: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    build: z.ZodOptional<z.ZodObject<{
+        dockerfile: z.ZodString;
+        context: z.ZodString;
+    }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        category: z.ZodOptional<z.ZodString>;
+        color: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    fga: z.ZodOptional<z.ZodObject<{
+        types: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            relations: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodObject<{
+                computedUserset: z.ZodObject<{
+                    object: z.ZodString;
+                    relation: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>]>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type NovaSpec = z.infer<typeof NovaSpecSchema>;
+/**
+ * Parse nova.yaml content and validate against the NovaSpec schema.
+ * Unknown fields are stripped; missing required fields throw an error.
+ * @param yamlContent String contents of a nova.yaml specification
+ * @returns Parsed NovaSpec object
+ * @throws Error with validation details if parsing or validation fail
+ */
+export declare function parseNovaSpec(yamlContent: string): NovaSpec;

package/dist/parseSpec.js

@@ -0,0 +1,101 @@
+import { parse as parseYAML } from "yaml";
+import { z } from "zod";
+// Zod schema for nova.yaml
+export const NovaSpecSchema = z.object({
+    apiVersion: z.string(),
+    kind: z.string(),
+    metadata: z.object({
+        name: z.string(),
+        displayName: z.string().optional(),
+        description: z.string().optional(),
+        icon: z.string().optional(),
+        tags: z.array(z.string()).optional(),
+    }),
+    spec: z.object({
+        runtime: z.object({
+            type: z.string(),
+            image: z.string(),
+            resources: z.object({
+                cpu: z.string(),
+                memory: z.string(),
+            }),
+            command: z.array(z.string()),
+            queue: z.string(),
+            port: z.number(),
+            envSpec: z.array(z.object({
+                name: z.string(),
+                value: z.string().optional(),
+                secret: z.boolean().optional(),
+                default: z.string().optional(),
+            })).optional(),
+        }),
+        actions: z.array(z.object({
+            name: z.string(),
+            displayName: z.string().optional(),
+            description: z.string().optional(),
+            icon: z.string().optional(),
+            async: z.boolean().optional(),
+            input: z.unknown().optional(), // JSON schema object
+            output: z.unknown().optional(), // JSON schema object
+            schema: z.object({
+                input: z.string(),
+                output: z.string(),
+            }).optional(),
+            fga: z.object({
+                resourceType: z.string(),
+                relation: z.string(),
+            }).optional(),
+        })),
+    }),
+    build: z.object({
+        dockerfile: z.string(),
+        context: z.string(),
+    }).optional(),
+    ui: z.object({
+        category: z.string().optional(),
+        color: z.string().optional(),
+    }).optional(),
+    // OpenFGA policy hints embedded in nova.yaml
+    fga: z.object({
+        types: z.array(z.object({
+            name: z.string(),
+            relations: z.record(z.string(), z.union([
+                z.array(z.string()),
+                z.object({
+                    computedUserset: z.object({
+                        object: z.string(),
+                        relation: z.string(),
+                    }),
+                }),
+            ])),
+        })),
+    }).optional(),
+}).strict();
+/**
+ * Parse nova.yaml content and validate against the NovaSpec schema.
+ * Unknown fields are stripped; missing required fields throw an error.
+ * @param yamlContent String contents of a nova.yaml specification
+ * @returns Parsed NovaSpec object
+ * @throws Error with validation details if parsing or validation fail
+ */
+export function parseNovaSpec(yamlContent) {
+    let parsed;
+    try {
+        parsed = parseYAML(yamlContent);
+    }
+    catch (e) {
+        throw new Error(`Failed to parse YAML content: ${e.message}`);
+    }
+    try {
+        return NovaSpecSchema.parse(parsed);
+    }
+    catch (e) {
+        if (e instanceof z.ZodError) {
+            const details = e.issues
+                .map((issue) => `Path '${issue.path.join(".")}': ${issue.message}`)
+                .join("; ");
+            throw new Error(`nova.yaml validation error(s): ${details}`);
+        }
+        throw e;
+    }
+}

package/dist/workerSchema.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+/**
+ * Schema for code-level defineWorker() argument.
+ * This enforces worker metadata, actions, envSpec, and optional FGA hints.
+ */
+export declare const WorkerDefSchema: z.ZodObject<{
+    name: z.ZodString;
+    queue: z.ZodString;
+    envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        secret: z.ZodBoolean;
+        default: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    fga: z.ZodOptional<z.ZodObject<{
+        types: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            relations: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodObject<{
+                computedUserset: z.ZodObject<{
+                    object: z.ZodString;
+                    relation: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$strip>]>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    actions: z.ZodRecord<z.ZodString, z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        input: z.ZodAny;
+        output: z.ZodAny;
+        method: z.ZodOptional<z.ZodEnum<{
+            GET: "GET";
+            POST: "POST";
+            PUT: "PUT";
+            DELETE: "DELETE";
+            PATCH: "PATCH";
+        }>>;
+        path: z.ZodOptional<z.ZodString>;
+        fga: z.ZodOptional<z.ZodObject<{
+            resourceType: z.ZodString;
+            relation: z.ZodString;
+            resourceIdKey: z.ZodOptional<z.ZodString>;
+            policy: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        handler: z.ZodAny;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type WorkerDef = z.infer<typeof WorkerDefSchema>;

package/dist/workerSchema.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+/**
+ * Schema for code-level defineWorker() argument.
+ * This enforces worker metadata, actions, envSpec, and optional FGA hints.
+ */
+export const WorkerDefSchema = z.object({
+    name: z.string(),
+    queue: z.string(),
+    // Optional environment variable spec for nova.yaml generation
+    envSpec: z.array(z.object({ name: z.string(), secret: z.boolean(), default: z.string().optional() })).optional(),
+    // Optional top-level FGA policy types
+    fga: z.object({
+        types: z.array(z.object({
+            name: z.string(),
+            relations: z.record(z.string(), z.union([
+                z.array(z.string()),
+                z.object({ computedUserset: z.object({ object: z.string(), relation: z.string() }) })
+            ])),
+        }))
+    }).optional(),
+    // Map of action definitions
+    actions: z.record(z.string(), z.object({
+        name: z.string().optional(),
+        input: z.any(), // Zod schema instance expected
+        output: z.any(), // Zod schema instance expected
+        // NEW: HTTP routing support for oRPC
+        method: z.enum(['GET', 'POST', 'PUT', 'DELETE', 'PATCH']).optional(),
+        path: z.string().optional(),
+        // Optional per-action OpenFGA hints: resource type, relation, ID key, and optional policy caveat
+        fga: z.object({
+            resourceType: z.string(),
+            relation: z.string(),
+            resourceIdKey: z.string().optional(),
+            policy: z.string().optional(),
+        }).optional(),
+        handler: z.any(), // function with signature (input, ctx) => Promise<…>
+    })),
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newhomestar/sdk",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Type-safe SDK for building Nova pipelines (workers & functions)",
   "homepage": "https://github.com/newhomestar/nova-node-sdk#readme",
   "bugs": {