@pramen/server 0.0.1

package/dist/sdk/infer.d.ts

@@ -0,0 +1,79 @@
+import type { DefaultValue, EntityDef, EntityFields, FieldDef, RelationDefs, SchemaDef } from "./schema";
+import type { FileRef } from "./files";
+export type { FileRef } from "./files";
+/** Any JSON-serializable value — the type of a `t.json()` column. */
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** SQL field type -> TypeScript value type. */
+export type FieldTsType<D extends FieldDef> = D["type"] extends "text" ? string : D["type"] extends "boolean" ? boolean : D["type"] extends "json" ? JsonValue : D["type"] extends "fileRef" ? FileRef : number;
+/** A column is non-null iff it's NOT NULL or a primary key. */
+type IsNotNull<D extends FieldDef> = D extends {
+    notNull: true;
+} ? true : D extends {
+    primaryKey: true;
+} ? true : false;
+export type Cell<D extends FieldDef> = IsNotNull<D> extends true ? FieldTsType<D> : FieldTsType<D> | null;
+/** Row shape returned from reads. */
+export type InferRow<F extends EntityFields> = {
+    [K in keyof F]: Cell<F[K]>;
+};
+/** A row whose fields may be projected away by field-level (incl. cell-level) ACL:
+ * every column optional. The honest type for a handler that reads through a policy
+ * which can drop columns per row — `InferRow` over-claims presence by design. */
+export type ProjectedRow<F extends EntityFields> = {
+    [K in keyof F]?: Cell<F[K]>;
+};
+/** Operators available on a column predicate. `like` is string-only. */
+export interface WhereOps<V> {
+    eq?: V | null;
+    ne?: V | null;
+    gt?: V;
+    gte?: V;
+    lt?: V;
+    lte?: V;
+    in?: V[];
+    notIn?: V[];
+    like?: V extends string ? string : never;
+    isNull?: boolean;
+}
+/** Predicate input: per-column equality shorthand or an operator object, plus
+ * nestable AND/OR groups. */
+export type WhereInput<F extends EntityFields> = {
+    [K in keyof F]?: FieldTsType<F[K]> | null | WhereOps<FieldTsType<F[K]>>;
+} & {
+    AND?: WhereInput<F>[];
+    OR?: WhereInput<F>[];
+};
+/** Patch input for updates: every column optional, value typed (nullable). */
+export type InferUpdate<F extends EntityFields> = Partial<{
+    [K in keyof F]: FieldTsType<F[K]> | null;
+}>;
+type RequiredInsertKeys<F extends EntityFields> = {
+    [K in keyof F]: IsNotNull<F[K]> extends true ? F[K] extends {
+        autoIncrement: true;
+    } ? never : F[K] extends {
+        default: DefaultValue;
+    } ? never : K : never;
+}[keyof F];
+type OptionalInsertKeys<F extends EntityFields> = Exclude<keyof F, RequiredInsertKeys<F>>;
+export type InferInsert<F extends EntityFields> = {
+    [K in RequiredInsertKeys<F>]: FieldTsType<F[K]>;
+} & {
+    [K in OptionalInsertKeys<F>]?: FieldTsType<F[K]> | null;
+};
+/** Extract a schema entry's fields, e.g. FieldsOf<S["notes"]>. */
+export type FieldsOf<E> = E extends EntityDef<infer F, RelationDefs> ? F : never;
+/** Extract a schema entry's relations. */
+export type RelationsOf<E> = E extends EntityDef<EntityFields, infer R> ? R : Record<string, never>;
+type RelValue<S extends SchemaDef, Rel> = Rel extends {
+    kind: "belongsTo";
+    target: infer Tg;
+} ? Tg extends keyof S ? InferRow<FieldsOf<S[Tg]>> | null : never : Rel extends {
+    kind: "hasMany";
+    target: infer Tg;
+} ? Tg extends keyof S ? InferRow<FieldsOf<S[Tg]>>[] : never : never;
+/** The relation properties added to a row by `with`. Optional (present only when selected). */
+export type RelationsResult<S extends SchemaDef, T extends keyof S> = Partial<{
+    [K in keyof RelationsOf<S[T]>]: RelValue<S, RelationsOf<S[T]>[K]>;
+}>;

package/dist/sdk/infer.js

@@ -0,0 +1,5 @@
+// Type-level inference from a schema's field definitions: WhereInput / InferInsert
+// / InferRow. Pure types; erased at runtime. Relies on field builders preserving
+// literals (`as const`), so e.g.
+// `t.id()` is `{ type: "integer"; primaryKey: true; autoIncrement: true; notNull: true }`.
+export {};

package/dist/sdk/schema.d.ts

@@ -0,0 +1,112 @@
+export type FieldType = "text" | "integer" | "real" | "boolean" | "json" | "fileRef";
+/** A SQL DEFAULT literal (used by the migrator + DDL). */
+export type DefaultValue = string | number | boolean | null;
+export interface FieldDef {
+    readonly type: FieldType;
+    readonly primaryKey?: boolean;
+    readonly autoIncrement?: boolean;
+    readonly notNull?: boolean;
+    /** A UNIQUE constraint (enforced via a unique index). */
+    readonly unique?: boolean;
+    /** A (non-unique) index on this column. */
+    readonly index?: boolean;
+    /** A column DEFAULT (a literal). Makes the column optional on insert. */
+    readonly default?: DefaultValue;
+    /** Migration hint: this column was previously named X. On boot the migrator
+     * rebuilds the table, copying data from the old column. A diff cannot tell a
+     * rename from a drop+add, so the rename must be declared explicitly. */
+    readonly renamedFrom?: string;
+}
+declare const builders: {
+    id: () => {
+        readonly type: "integer";
+        readonly primaryKey: true;
+        readonly autoIncrement: true;
+        readonly notNull: true;
+    };
+    textId: () => {
+        readonly type: "text";
+        readonly primaryKey: true;
+        readonly notNull: true;
+    };
+    text: () => {
+        readonly type: "text";
+    };
+    int: () => {
+        readonly type: "integer";
+    };
+    real: () => {
+        readonly type: "real";
+    };
+    bool: () => {
+        readonly type: "boolean";
+    };
+    /** Arbitrary JSON, stored in a TEXT column. Handlers read/write the parsed value
+     * (a JsonValue); db.ts stringifies on write and parses on read. */
+    json: () => {
+        readonly type: "json";
+    };
+    /** A reference to a stored file (R2 object). Holds JSON metadata (a FileRef),
+     * not the bytes — upload/download go through ctx.files + the Worker /files/* route. */
+    fileRef: () => {
+        readonly type: "fileRef";
+    };
+};
+export type FieldBuilders = typeof builders;
+export type EntityFields = Record<string, FieldDef>;
+export interface BelongsToDef<T extends string = string> {
+    readonly kind: "belongsTo";
+    readonly target: T;
+    /** Local column holding the target's primary key. */
+    readonly column: string;
+}
+export interface HasManyDef<T extends string = string> {
+    readonly kind: "hasMany";
+    readonly target: T;
+    /** Column on the target referring back to this entity's primary key. */
+    readonly column: string;
+}
+export type RelationDef = BelongsToDef | HasManyDef;
+export type RelationDefs = Record<string, RelationDef>;
+declare const relationBuilders: {
+    belongsTo: <T extends string>(target: T, column: string) => {
+        readonly kind: "belongsTo";
+        readonly target: T;
+        readonly column: string;
+    };
+    hasMany: <T extends string>(target: T, column: string) => {
+        readonly kind: "hasMany";
+        readonly target: T;
+        readonly column: string;
+    };
+};
+export type RelationBuilders = typeof relationBuilders;
+export interface EntityDef<F extends EntityFields = EntityFields, R extends RelationDefs = Record<string, never>> {
+    readonly fields: F;
+    readonly relations: R;
+}
+export declare function Entity<F extends EntityFields, R extends RelationDefs = Record<string, never>>(build: (t: FieldBuilders) => F, relations?: (r: RelationBuilders) => R): EntityDef<F, R>;
+/** Annotate a field as renamed from a previous column name (migration hint). Wraps
+ * a builder result, preserving its literal field type: `title: renamedFrom(t.text(), "name")`. */
+export declare function renamedFrom<F extends FieldDef>(field: F, from: string): F & {
+    readonly renamedFrom: string;
+};
+/** Mark a column NOT NULL. */
+export declare function notNull<F extends FieldDef>(field: F): F & {
+    readonly notNull: true;
+};
+/** Add a UNIQUE constraint (enforced via a unique index). */
+export declare function unique<F extends FieldDef>(field: F): F & {
+    readonly unique: true;
+};
+/** Add a (non-unique) index on the column. */
+export declare function indexed<F extends FieldDef>(field: F): F & {
+    readonly index: true;
+};
+/** Give the column a DEFAULT (a literal) — also makes it optional on insert. */
+export declare function defaultTo<F extends FieldDef, D extends DefaultValue>(field: F, value: D): F & {
+    readonly default: D;
+};
+export type SchemaDef = Record<string, EntityDef<EntityFields, RelationDefs>>;
+export declare function defineSchema<S extends SchemaDef>(entities: S): S;
+export {};

package/dist/sdk/schema.js

@@ -0,0 +1,56 @@
+// Schema definition — the portable layer: an `Entity(t => ({...}))` factory and
+// `defineSchema({...})`. Field builders return `as const` literals so
+// the exact field shape survives into the type system; sdk/infer.ts turns that
+// shape into row/where/insert types.
+//
+// Entities may also declare relations (belongsTo / hasMany) via a second builder.
+// Relations reference their target table by name (resolved at runtime) and the
+// foreign-key column. Relation traversal is ACL-governed (see runtime/acl.ts).
+const builders = {
+    id: () => ({ type: "integer", primaryKey: true, autoIncrement: true, notNull: true }),
+    textId: () => ({ type: "text", primaryKey: true, notNull: true }),
+    text: () => ({ type: "text" }),
+    int: () => ({ type: "integer" }),
+    real: () => ({ type: "real" }),
+    bool: () => ({ type: "boolean" }),
+    /** Arbitrary JSON, stored in a TEXT column. Handlers read/write the parsed value
+     * (a JsonValue); db.ts stringifies on write and parses on read. */
+    json: () => ({ type: "json" }),
+    /** A reference to a stored file (R2 object). Holds JSON metadata (a FileRef),
+     * not the bytes — upload/download go through ctx.files + the Worker /files/* route. */
+    fileRef: () => ({ type: "fileRef" }),
+};
+const relationBuilders = {
+    belongsTo: (target, column) => ({ kind: "belongsTo", target, column }),
+    hasMany: (target, column) => ({ kind: "hasMany", target, column }),
+};
+export function Entity(build, relations) {
+    return { fields: build(builders), relations: (relations ? relations(relationBuilders) : {}) };
+}
+/** Annotate a field as renamed from a previous column name (migration hint). Wraps
+ * a builder result, preserving its literal field type: `title: renamedFrom(t.text(), "name")`. */
+export function renamedFrom(field, from) {
+    return { ...field, renamedFrom: from };
+}
+// --- field modifiers — wrap a builder result, preserving its literal type. They
+// compose: `unique(notNull(t.text()))`, `defaultTo(t.int(), 0)`. (Wrapper style,
+// like renamedFrom — avoids the method/field name clash a `.notNull()` chain hits.)
+/** Mark a column NOT NULL. */
+export function notNull(field) {
+    return { ...field, notNull: true };
+}
+/** Add a UNIQUE constraint (enforced via a unique index). */
+export function unique(field) {
+    return { ...field, unique: true };
+}
+/** Add a (non-unique) index on the column. */
+export function indexed(field) {
+    return { ...field, index: true };
+}
+/** Give the column a DEFAULT (a literal) — also makes it optional on insert. */
+export function defaultTo(field, value) {
+    return { ...field, default: value };
+}
+export function defineSchema(entities) {
+    return entities;
+}

package/dist/worker-entry.d.ts

@@ -0,0 +1,3 @@
+export { createPramen, type PramenApp, type PublicRoute, type Env, type DoEnv } from "./pramen";
+export { makeWorker, callPrivileged } from "./worker";
+export { pramenDO, PramenDOBase } from "./durable-object";

package/dist/worker-entry.js

@@ -0,0 +1,8 @@
+// @pramen/server/worker — the DEPLOY entry. This is the only entry that pulls in
+// the Durable Object (and thus `cloudflare:workers`), so it is kept separate from
+// the main authoring entry: tools that merely load an app.ts to read its schema
+// (the CLI, tests, codegen) import from "@pramen/server" and never drag in the DO
+// runtime. A Worker's entry imports createPramen from here.
+export { createPramen } from "./pramen";
+export { makeWorker, callPrivileged } from "./worker";
+export { pramenDO, PramenDOBase } from "./durable-object";

package/dist/worker.d.ts

@@ -0,0 +1,41 @@
+import type { PramenApp } from "./pramen";
+export interface Env {
+    PRAMEN: DurableObjectNamespace;
+    /** Project KV — tenant registry (`tenant:` keys) + handler ctx.kv (`app:` keys). */
+    KV: KVNamespace;
+    /** HMAC secret for verifying HS256 bearer JWTs. Dev value in wrangler.jsonc;
+     * production via `wrangler secret put AUTH_SECRET`. Ignored if JWKS_URL is set. */
+    AUTH_SECRET: string;
+    /** Optional: a JWKS endpoint. When set, tokens are verified as RS256 against the
+     * fetched public keys (HmacStrategy/AUTH_SECRET is bypassed). */
+    JWKS_URL?: string;
+    /** D1 binding. Enables the "Worker + D1 (no DO)" path — the same schema/ACL/read
+     * engine over D1 instead of a Durable Object. Selected per-request via
+     * `x-pramen-store: d1`. RPC only (live queries need the DO). */
+    DB?: D1Database;
+    /** R2 bucket backing file storage (ctx.files + the /files/* route). */
+    FILES: R2Bucket;
+    /** HMAC secret for signing file tokens. Falls back to AUTH_SECRET if unset. */
+    FILES_SECRET?: string;
+    /** Optional CORS allowlist for /rpc + /live: comma-separated origins, or `*`.
+     * Unset = no CORS headers (same-origin only). Lets a browser client call a
+     * cross-origin Worker directly (e.g. a separate dev port). */
+    CORS_ORIGINS?: string;
+    /** "true" to apply destructive schema migrations on the D1 path. Off by default. */
+    PRAMEN_ALLOW_DESTRUCTIVE?: string;
+}
+/** Forward a privileged mutation into a tenant's DO from a public route. The
+ * synthetic identity (default `["admin"]`) is trusted because the call originates
+ * in the Worker — the same internal mechanism the admin endpoints use. Returns the
+ * DO's JSON response (`{ ok, result }` / `{ ok: false, … }`). */
+export declare function callPrivileged(env: Env, opts: {
+    name: string;
+    input?: unknown;
+    tenant?: string;
+    roles?: string[];
+}): Promise<Response>;
+/** Build the Worker fetch handler for an app. State (the JWKS cache, the D1
+ * compiled-ACL + one-time migration) is per-app, held in this closure. */
+export declare function makeWorker(app: PramenApp): {
+    fetch(request: Request, env: Env): Promise<Response>;
+};

package/dist/worker.js

@@ -0,0 +1,213 @@
+// makeWorker(app) — builds the stateless HTTP front door bound to an app. It
+// authenticates the request, authorizes the tenant, and routes /rpc/<handler> and
+// /live to the per-tenant Durable Object, plus the /files/* route and admin
+// endpoints (/tenants, /admin/recover, /admin/schema). createPramen() pairs the
+// returned fetch with the matching DO class; a consumer just re-exports both.
+import { authorizeTenant, HmacStrategy, isAdmin, JwksStrategy, resolveIdentity } from "./auth";
+import { dispatch } from "./runtime/dispatch";
+import { migrate } from "./runtime/migrate";
+import { compileAcl } from "./runtime/acl";
+import { D1Driver } from "./runtime/driver";
+import { toResponse } from "./runtime/errors";
+import { Kv } from "./runtime/kv";
+import { createFiles, handleFileRequest, R2Adapter } from "./runtime/storage";
+/** The secret used to sign/verify file tokens — a dedicated FILES_SECRET if set,
+ * else AUTH_SECRET (so HS256 setups work out of the box). */
+const filesSecret = (env) => env.FILES_SECRET || env.AUTH_SECRET;
+const json = (body, status = 200) => Response.json(body, { status });
+const forbidden = (what) => json({ ok: false, error: `access denied: ${what}`, code: "forbidden" }, 403);
+const badRequest = (msg) => json({ ok: false, error: msg, code: "bad_request" }, 400);
+/** CORS response headers for an allowed origin, or `{}` when CORS is off / the
+ * origin isn't allowlisted. Authorization is a request header, never a cookie, so
+ * `*` is safe (no credentials mode). */
+function corsHeaders(origin, env) {
+    if (!origin || !env.CORS_ORIGINS)
+        return {};
+    const allow = env.CORS_ORIGINS.split(",").map((s) => s.trim()).filter(Boolean);
+    if (!allow.includes("*") && !allow.includes(origin))
+        return {};
+    return {
+        "access-control-allow-origin": allow.includes("*") ? "*" : origin,
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-allow-headers": "content-type, authorization, x-pramen-tenant, x-pramen-store",
+        vary: "origin",
+    };
+}
+/** Return a copy of `res` with the CORS headers merged in (no-op if none). */
+function withCors(res, cors) {
+    if (Object.keys(cors).length === 0)
+        return res;
+    const headers = new Headers(res.headers);
+    for (const [k, v] of Object.entries(cors))
+        headers.set(k, v);
+    return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}
+/** Forward a privileged mutation into a tenant's DO from a public route. The
+ * synthetic identity (default `["admin"]`) is trusted because the call originates
+ * in the Worker — the same internal mechanism the admin endpoints use. Returns the
+ * DO's JSON response (`{ ok, result }` / `{ ok: false, … }`). */
+export async function callPrivileged(env, opts) {
+    const tenant = opts.tenant ?? "main";
+    const stub = env.PRAMEN.get(env.PRAMEN.idFromName(tenant));
+    return stub.fetch(new Request(`https://do/rpc/${opts.name}`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-pramen-tenant": tenant,
+            "x-pramen-identity": JSON.stringify({ roles: opts.roles ?? ["admin"] }),
+        },
+        body: JSON.stringify(opts.input ?? {}),
+    }));
+}
+/** Build the Worker fetch handler for an app. State (the JWKS cache, the D1
+ * compiled-ACL + one-time migration) is per-app, held in this closure. */
+export function makeWorker(app) {
+    // JwksStrategy caches fetched public keys, so keep one instance per isolate (keyed
+    // by URL) rather than rebuilding it per request. HmacStrategy is stateless.
+    let jwks;
+    const strategyFor = (env) => {
+        if (env.JWKS_URL) {
+            if (!jwks || jwks.url !== env.JWKS_URL)
+                jwks = new JwksStrategy(env.JWKS_URL);
+            return jwks;
+        }
+        return new HmacStrategy(env.AUTH_SECRET);
+    };
+    // ACL is compiled once per isolate; the Worker's D1 path reuses it (the DO compiles
+    // its own). Schema migration over D1 runs once per isolate (and short-circuits on a
+    // stored schema hash thereafter); a failed run is not cached.
+    const d1Acl = compileAcl(app.acl ?? []);
+    let d1Ready;
+    const ensureD1Migrated = (driver, allowDestructive) => {
+        if (!d1Ready) {
+            d1Ready = migrate(driver, app.schema, { allowDestructive })
+                .then(() => undefined)
+                .catch((e) => {
+                d1Ready = undefined;
+                throw e;
+            });
+        }
+        return d1Ready;
+    };
+    return {
+        async fetch(request, env) {
+            const url = new URL(request.url);
+            // File upload/download stream through the Worker (bytes never touch the DO),
+            // authorized purely by the HMAC token in the url — no JWT/tenant routing.
+            if (url.pathname.startsWith("/files/")) {
+                const res = await handleFileRequest(request, { adapter: new R2Adapter(env.FILES), secret: filesSecret(env) });
+                if (res)
+                    return res;
+            }
+            // Public (pre-auth) routes — matched before identity resolution, so a
+            // signature-authed webhook can live outside the JWT-gated /rpc surface.
+            for (const r of app.routes ?? []) {
+                if (request.method === r.method && url.pathname === r.path) {
+                    const routeCtx = { callPrivileged: (opts) => callPrivileged(env, opts) };
+                    return r.handler(request, env, routeCtx);
+                }
+            }
+            // CORS (opt-in via CORS_ORIGINS) for cross-origin browser clients. Answer the
+            // preflight before any auth so the actual request can carry the bearer token.
+            const cors = corsHeaders(request.headers.get("origin"), env);
+            if (request.method === "OPTIONS" && Object.keys(cors).length > 0) {
+                return new Response(null, { status: 204, headers: cors });
+            }
+            const isWs = request.headers.get("Upgrade") === "websocket";
+            // Browser WebSockets can't set headers, so /live accepts the bearer token and
+            // tenant via the query string; fold them into headers for the rest of the flow.
+            let req = request;
+            if (isWs) {
+                const h = new Headers(request.headers);
+                const qToken = url.searchParams.get("token");
+                if (qToken && !h.get("authorization"))
+                    h.set("authorization", `Bearer ${qToken}`);
+                const qTenant = url.searchParams.get("tenant");
+                if (qTenant && !h.get("x-pramen-tenant"))
+                    h.set("x-pramen-tenant", qTenant);
+                req = new Request(request, { headers: h });
+            }
+            const identity = await resolveIdentity(req, strategyFor(env));
+            // --- admin: list known tenants ---
+            if (url.pathname === "/tenants") {
+                if (!isAdmin(identity))
+                    return forbidden("tenants");
+                const list = await env.KV.list({ prefix: "tenant:" });
+                return json({ ok: true, result: list.keys.map((k) => k.name.slice("tenant:".length)) });
+            }
+            // --- admin: point-in-time recovery for a tenant ---
+            if (url.pathname === "/admin/recover" && request.method === "POST") {
+                if (!isAdmin(identity))
+                    return forbidden("recover");
+                const body = (await request.json().catch(() => ({})));
+                if (typeof body.tenant !== "string" || !body.tenant)
+                    return badRequest("tenant required");
+                if (typeof body.timestamp !== "number" && typeof body.timestamp !== "string")
+                    return badRequest("timestamp required");
+                const stub = env.PRAMEN.get(env.PRAMEN.idFromName(body.tenant));
+                const internal = new Request("https://do/__recover", {
+                    method: "POST",
+                    headers: { "content-type": "application/json", "x-pramen-tenant": body.tenant },
+                    body: JSON.stringify({ timestamp: body.timestamp }),
+                });
+                return stub.fetch(internal);
+            }
+            // --- admin: a tenant's applied schema (hash + tables) ---
+            if (url.pathname === "/admin/schema") {
+                if (!isAdmin(identity))
+                    return forbidden("schema");
+                const tenant = url.searchParams.get("tenant") ?? "main";
+                const stub = env.PRAMEN.get(env.PRAMEN.idFromName(tenant));
+                return stub.fetch(new Request("https://do/__schema", { headers: { "x-pramen-tenant": tenant } }));
+            }
+            const isRpc = url.pathname.startsWith("/rpc/");
+            const isLive = url.pathname === "/live";
+            if (!isRpc && !(isLive && isWs)) {
+                return new Response("pramen — POST /rpc/<handler> (JSON body), or WebSocket /live for live queries. " +
+                    "Header X-Pramen-Tenant selects the store (default: main). " +
+                    "Admin: GET /tenants, POST /admin/recover {tenant,timestamp}, GET /admin/schema?tenant=.\n", { headers: { "content-type": "text/plain" } });
+            }
+            // Authorize the tenant against the identity before reaching the DO, so a
+            // caller can't address (or register) tenants they have no claim to.
+            const tenant = req.headers.get("x-pramen-tenant") ?? "main";
+            if (!authorizeTenant(identity, tenant))
+                return withCors(forbidden(`tenant '${tenant}'`), cors);
+            // --- Worker + D1 (no DO): the same schema/ACL/read engine over a D1 binding,
+            // selected per-request via `x-pramen-store: d1`. RPC only — live queries need the
+            // DO (single writer + a socket host). This proof uses ONE shared D1 database
+            // across tenants; a real product would add a tenant column or a per-tenant DB.
+            if (req.headers.get("x-pramen-store") === "d1") {
+                if (!env.DB)
+                    return badRequest("D1 store is not configured");
+                if (isLive)
+                    return badRequest("live queries require the default (DO) store");
+                const name = url.pathname.replace(/^\/rpc\//, "");
+                let input;
+                if (request.method === "POST")
+                    input = await request.json().catch(() => undefined);
+                const driver = new D1Driver(env.DB);
+                const files = createFiles({ tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
+                const envBag = env;
+                try {
+                    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+                    const { result } = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, envBag, { acl: d1Acl, identity }, name, input);
+                    return withCors(json({ ok: true, result }), cors);
+                }
+                catch (err) {
+                    const { status, body } = toResponse(err);
+                    return withCors(json(body, status), cors);
+                }
+            }
+            // Forward a trusted identity to the DO (the DO never re-derives it).
+            const headers = new Headers(req.headers);
+            if (identity)
+                headers.set("x-pramen-identity", JSON.stringify(identity));
+            else
+                headers.delete("x-pramen-identity");
+            const stub = env.PRAMEN.get(env.PRAMEN.idFromName(tenant));
+            // WebSocket upgrades (101) must be returned untouched; only add CORS to HTTP.
+            const res = await stub.fetch(new Request(req, { headers }));
+            return isWs ? res : withCors(res, cors);
+        },
+    };
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@pramen/server",
+  "version": "0.0.1",
+  "description": "pramen server runtime — schema, ACL, ORM, live queries, files, and the createPramen(app) factory for Cloudflare Workers + Durable Objects.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/netvarec/pramen.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://github.com/netvarec/pramen#readme",
+  "bugs": "https://github.com/netvarec/pramen/issues",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "bun": "./src/index.ts",
+      "workerd": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./worker": {
+      "development": "./src/worker-entry.ts",
+      "bun": "./src/worker-entry.ts",
+      "workerd": "./src/worker-entry.ts",
+      "types": "./dist/worker-entry.d.ts",
+      "default": "./dist/worker-entry.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": ["dist", "src"],
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250101.0"
+  }
+}