@pramen/server 0.0.48 → 0.0.50

package/dist/worker.js

@@ -18,6 +18,10 @@ import { Kv, isSessionDenied } from "./runtime/kv";
 import { listDOs, partitionDoName } from "./runtime/registry";
 import { createFiles, handleFileRequest, handleMediaRequest, R2Adapter } from "./runtime/storage";
 import { DEFAULT_PARTITION, partitionsOf } from "./sdk/schema";
+/** Widen the closed `Env` interface to the open `EnvBag` handlers and services see.
+ * Spreading yields an anonymous object type, which TypeScript gives an implicit index
+ * signature — so this needs no type assertion. */
+const envBag = (env) => ({ ...env });
 /** The secret used to sign/verify file tokens — a dedicated FILES_SECRET if set,
  * else AUTH_SECRET (so HS256 setups work out of the box). */
 const filesSecret = (env) => env.FILES_SECRET || env.AUTH_SECRET;
@@ -172,7 +176,10 @@ export function makeWorker(app) {
         const files = createFiles({ tenant: "main", secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
         const db = new Db(driver, { acl: d1Acl, identity, system: true, schema: app.schema, suppressTriggers: true }, app.schema);
         const kv = new Kv(env.KV);
-        return { db, kv, files, env: env, identity, tasks: tasksFacade(driver), mail: createMail(env, kv), queue: createQueue(env) };
+        const bag = envBag(env);
+        // The D1 store is not per-tenant addressed (one shared database, no DO), so the
+        // task context runs as the default tenant — matching the `files` scope just above.
+        return { db, kv, files, env: bag, identity, tenant: "main", store: "d1", tasks: tasksFacade(driver), mail: createMail(bag, kv), queue: createQueue(bag) };
     };
     /** Drain the D1 outbox in the Worker (no DO/alarm on this path) — called by the
      * /admin/tasks/drain route with `x-pramen-store: d1`, and by `scheduled()` (Cron). */
@@ -216,7 +223,7 @@ export function makeWorker(app) {
             for (const r of app.routes ?? []) {
                 if (request.method === r.method && url.pathname === r.path) {
                     const routeCtx = { callPrivileged: (opts) => callPrivileged(env, opts) };
-                    return r.handler(request, env, routeCtx);
+                    return r.handler(request, envBag(env), routeCtx);
                 }
             }
             // CORS (opt-in via CORS_ORIGINS) for cross-origin browser clients. Answer the
@@ -396,9 +403,10 @@ export function makeWorker(app) {
                 }
                 // (isLive is excluded by useD1Store — live always routes to the DO below.)
                 const name = url.pathname.replace(/^\/rpc\//, "");
-                let input;
+                // The RPC body is JSON — parse it into the domain type once, here at the boundary.
+                let input = null;
                 if (request.method === "POST")
-                    input = await request.json().catch(() => undefined);
+                    input = ((await request.json().catch(() => null)) ?? null);
                 // Pick where the D1 session may start its first read. A mutation ALWAYS pins the
                 // primary (`first-primary` is a superset of read-your-writes) so a read-modify-write
                 // can't run off a lagging replica — an inbound bookmark must not widen that window.
@@ -414,10 +422,12 @@ export function makeWorker(app) {
                     start = "first-unconstrained";
                 const driver = new D1Driver(env.DB, { start });
                 const files = createFiles({ tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
-                const envBag = env;
+                const bag = envBag(env);
                 try {
                     await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
-                    const { result, enqueued } = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, envBag, { acl: d1Acl, identity }, name, input);
+                    // `tenant` matters here: a handler minting a tenant-scoped capability (a signed
+                    // preview link) would otherwise stamp it "main" while reading acme's rows.
+                    const { result, enqueued } = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, bag, { acl: d1Acl, identity, tenant, store: "d1" }, name, input);
                     // Kick an immediate drain in the request tail when this handler enqueued tasks
                     // (e.g. sendMagicLinkEmail). Without this, tasks wait for the next Cron trigger
                     // — up to a full minute. `waitUntil` lets the response return now while the
@@ -488,13 +498,13 @@ export function makeWorker(app) {
         // handler (ACK on success / RETRY on throw, per message). A consumer is Worker-level
         // (no tenant DO): its ctx carries env/kv/mail/queue + callPrivileged to reach a DO.
         async queue(batch, env) {
-            const envBag = env;
+            const bag = envBag(env);
             const kv = new Kv(env.KV);
             const ctx = {
-                env: envBag,
+                env: bag,
                 kv,
-                mail: createMail(envBag, kv),
-                queue: createQueue(envBag),
+                mail: createMail(bag, kv),
+                queue: createQueue(bag),
                 callPrivileged: (opts) => callPrivileged(env, opts),
             };
             await dispatchQueueBatch(app.queues ?? {}, ctx, batch);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pramen/server",
-  "version": "0.0.48",
-  "description": "pramen server runtime — schema, ACL, ORM, live queries, files, and the createPramen(app) factory for Cloudflare Workers + Durable Objects.",
+  "version": "0.0.50",
+  "description": "pramen server runtime \u2014 schema, ACL, ORM, live queries, files, and the createPramen(app) factory for Cloudflare Workers + Durable Objects.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -26,6 +26,13 @@
       "workerd": "./src/worker-entry.ts",
       "types": "./dist/worker-entry.d.ts",
       "default": "./dist/worker-entry.js"
+    },
+    "./dev": {
+      "development": "./src/dev.ts",
+      "bun": "./src/dev.ts",
+      "workerd": "./src/dev.ts",
+      "types": "./dist/dev.d.ts",
+      "default": "./dist/dev.js"
     }
   },
   "main": "./dist/index.js",
@@ -33,7 +40,10 @@
   "bin": {
     "pramen": "./dist/cli.js"
   },
-  "files": ["dist", "src"],
+  "files": [
+    "dist",
+    "src"
+  ],
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json"
   },

package/src/auth.ts

@@ -11,6 +11,7 @@
 // non-standard claims pass through.
 
 import type { Identity } from "./sdk/acl";
+import type { JsonObject } from "./sdk/infer";
 
 const STANDARD_CLAIMS = new Set(["exp", "iat", "nbf", "iss", "aud", "jti", "sub", "role", "roles", "userId"]);
 
@@ -34,7 +35,7 @@ interface JwtHeader {
 /** Verifies a JWT and returns its claims, or null if invalid. Implementations
  * differ only in how they verify the signature. */
 export interface VerifyStrategy {
-  verify(token: string): Promise<Record<string, unknown> | null>;
+  verify(token: string): Promise<JsonObject | null>;
 }
 
 /** Verify a signature over `${header}.${payload}` for the parsed header. */
@@ -69,7 +70,7 @@ async function verifyJwt(
   token: string,
   verifySignature: SignatureVerifier,
   opts: VerifyOptions = {},
-): Promise<Record<string, unknown> | null> {
+): Promise<JsonObject | null> {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
   const [h, p, sig] = parts;
@@ -89,7 +90,7 @@ async function verifyJwt(
   }
   if (!valid) return null;
 
-  let payload: Record<string, unknown>;
+  let payload: JsonObject;
   try {
     payload = JSON.parse(b64urlToString(p!));
   } catch {
@@ -113,7 +114,7 @@ export class HmacStrategy implements VerifyStrategy {
     private readonly opts: VerifyOptions = {},
   ) {}
 
-  verify(token: string): Promise<Record<string, unknown> | null> {
+  verify(token: string): Promise<JsonObject | null> {
     return verifyJwt(
       token,
       async (input, signature, header) => {
@@ -152,7 +153,7 @@ export class JwksStrategy implements VerifyStrategy {
     private readonly opts: VerifyOptions = {},
   ) {}
 
-  verify(token: string): Promise<Record<string, unknown> | null> {
+  verify(token: string): Promise<JsonObject | null> {
     return verifyJwt(
       token,
       async (input, signature, header) => {
@@ -219,7 +220,7 @@ export class JwksStrategy implements VerifyStrategy {
   }
 }
 
-function toIdentity(claims: Record<string, unknown>): Identity {
+function toIdentity(claims: JsonObject): Identity {
   const roles = Array.isArray(claims.roles)
     ? (claims.roles as string[])
     : typeof claims.role === "string"

package/src/cli.ts

@@ -21,37 +21,14 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createTableSql } from "./runtime/ddl";
 import { schemaHash } from "./runtime/migrate";
-import { diffSchemaShape, schemaShape, type SchemaShape } from "./runtime/schema-diff";
+import { diffSchemaFingerprint, schemaFingerprint, type SchemaFingerprint } from "./runtime/schema-diff";
 import { entitiesInPartition, partitionsOf, type SchemaDef } from "./sdk/schema";
+import { signDevToken } from "./runtime/dev-token";
 
-/** Mint an HS256 JWT — mirrors what a real auth service would issue, for local
- * dev/testing (`pramen token`, and the default token for `schema status`). Signs
- * with AUTH_SECRET when set, else the dev secret from the scaffolded oblaka.ts. */
-const DEV_SECRET = "dev-secret-change-me";
+/** The dev JWT claims `pramen token` mints. See `runtime/dev-token.ts` for the signer. */
+type TokenClaims = { sub: string; roles: string[]; tenants?: string[] };
 
-function bytesToB64url(bytes: Uint8Array): string {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-const strToB64url = (s: string) => bytesToB64url(new TextEncoder().encode(s));
-
-async function sign(payload: Record<string, unknown>): Promise<string> {
-  const secret = process.env.AUTH_SECRET || DEV_SECRET;
-  const now = Math.floor(Date.now() / 1000);
-  const header = strToB64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-  const body = strToB64url(JSON.stringify({ iat: now, exp: now + 3600, ...payload }));
-  const data = `${header}.${body}`;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"],
-  );
-  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
-  return `${data}.${bytesToB64url(new Uint8Array(sig))}`;
-}
+const sign = (payload: Record<string, unknown>): Promise<string> => signDevToken(payload);
 
 /** The sub-schema of a single partition (used to mirror the DO's per-partition hash,
  * which migrate() computes over exactly this subset). For a single-partition app the
@@ -102,7 +79,7 @@ Usage: pramen <command>
   init [dir]                scaffold a new project (app.ts + worker.ts + oblaka.ts)
   schema sql                print CREATE TABLE statements for the schema
   schema hash               print the schema hash
-  schema snapshot           save the schema shape to .pramen/schema.json
+  schema snapshot           save the schema fingerprint to .pramen/schema.json
   schema diff               compare the schema to the snapshot (safe vs unsafe)
   schema status             compare a deployed tenant's schema to the local schema
                             [--tenant t] [--url u] [--token jwt]
@@ -126,20 +103,27 @@ async function schemaCmd(sub: string | undefined): Promise<void> {
   if (sub === "snapshot") {
     const { schema } = await loadApp();
     mkdirSync(dirname(snapshotPath), { recursive: true });
-    const snap = { hash: schemaHash(schema), shape: schemaShape(schema) };
+    const snap = { hash: schemaHash(schema), fingerprint: schemaFingerprint(schema) };
     writeFileSync(snapshotPath, JSON.stringify(snap, null, 2) + "\n");
-    console.log(`wrote ${snapshotPath} (${Object.keys(snap.shape).length} tables)`);
+    console.log(`wrote ${snapshotPath} (${Object.keys(snap.fingerprint).length} tables)`);
     return;
   }
   if (sub === "diff") {
     const { schema } = await loadApp();
-    const next = schemaShape(schema);
+    const next = schemaFingerprint(schema);
     if (!existsSync(snapshotPath)) {
       console.log("no snapshot — run `pramen schema snapshot` to set a baseline.");
       return;
     }
-    const prev = (JSON.parse(readFileSync(snapshotPath, "utf8")) as { shape: SchemaShape }).shape;
-    const changes = diffSchemaShape(prev, next);
+    // `fingerprint` was called `shape` before; keep reading an existing snapshot so an
+    // upgrade doesn't force a re-baseline.
+    const snap = JSON.parse(readFileSync(snapshotPath, "utf8")) as {
+      fingerprint?: SchemaFingerprint;
+      // the pre-rename key, quoted because it names a stored JSON field, not a symbol
+      "shape"?: SchemaFingerprint;
+    };
+    const prev = snap.fingerprint ?? snap["shape"] ?? {};
+    const changes = diffSchemaFingerprint(prev, next);
     if (changes.length === 0) {
       console.log("no changes since snapshot.");
       return;
@@ -203,7 +187,7 @@ async function schemaCmd(sub: string | undefined): Promise<void> {
       console.log(`live:    ${live.hash ?? "(none)"}`);
       console.log(`current: ${current}`);
       console.log(upToDate ? "✓ up to date" : "⚠ BEHIND — migrates on the tenant's next boot");
-      const want = schemaShape(subset);
+      const want = schemaFingerprint(subset);
       for (const table of Object.keys(want)) {
         const liveCols = new Set(live.tables[table] ?? []);
         const missing = Object.keys(want[table]!.columns).filter((col) => !liveCols.has(col));
@@ -222,7 +206,9 @@ async function tokenCmd(args: string[]): Promise<void> {
   if (!sub) fail("token: <sub> required");
   const roles = pos.slice(1);
   const tenants = flag("tenant")?.split(",");
-  console.log(await sign({ sub, roles: roles.length ? roles : ["admin"], ...(tenants ? { tenants } : {}) }));
+  const claims: TokenClaims = { sub, roles: roles.length ? roles : ["admin"] };
+  if (tenants) claims.tenants = tenants;
+  console.log(await sign(claims));
 }
 
 function initCmd(args: string[]): void {

package/src/dev.ts

@@ -0,0 +1,10 @@
+// `@pramen/server/dev` — tooling helpers, deliberately NOT on the authoring entry point.
+//
+// `signDevToken` mints an HS256 JWT for local development: the `pramen` and `pramen-cms`
+// bins and the repo's test helper all use it. It is kept off `@pramen/server` because its
+// secret lookup reads `process.env.AUTH_SECRET`, which does not exist in a deployed
+// Worker (bindings and secrets arrive on `env`) — so an app handler importing it from the
+// main entry would silently sign with the PUBLISHED dev constant while appearing to honour
+// AUTH_SECRET. A separate subpath makes "this is dev tooling" part of the import.
+
+export { signDevToken, DEV_SECRET } from "./runtime/dev-token";

package/src/durable-object.ts

@@ -34,6 +34,8 @@ import type { Identity } from "./sdk/acl";
 import type { HandlerContext } from "./sdk/handlers";
 import type { PramenApp } from "./pramen";
 import type { ClientMsg, ServerMsg, Subscription } from "./runtime/protocol";
+import type { EnvBag } from "./sdk/handlers";
+import type { JsonValue } from "./sdk/infer";
 
 /** Durable per-socket state — kept SMALL and stable, since it rides the WebSocket
  * attachment which workerd caps at ~2 KB. Only auth/routing identity lives here so it
@@ -208,9 +210,10 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     }
 
     const name = new URL(request.url).pathname.replace(/^\/rpc\//, "");
-    let input: unknown;
+    // The RPC body is JSON — parse it into the domain type once, here at the boundary.
+    let input: JsonValue = null;
     if (request.method === "POST") {
-      input = await request.json().catch(() => undefined);
+      input = ((await request.json().catch(() => null)) ?? null) as JsonValue;
     }
 
     try {
@@ -260,6 +263,8 @@ export class PramenDOBase extends DurableObject<DoEnv> {
       files: this.filesFor(this.tenant),
       env: this.envBag,
       identity,
+      tenant: this.tenant,
+      store: "do",
       tasks: tasksFacade(this.driver),
       mail: createMail(this.envBag, this.kv),
       queue: createQueue(this.envBag),
@@ -354,12 +359,12 @@ export class PramenDOBase extends DurableObject<DoEnv> {
 
     switch (msg.type) {
       case "subscribe":
-        return this.onSubscribe(ws, msg.id, msg.name, msg.input);
+        return this.onSubscribe(ws, msg.id, msg.name, msg.input ?? null);
       case "unsubscribe":
         this.setSubs(ws, this.getSubs(ws).filter((s) => s.id !== msg.id));
         return;
       case "call":
-        return this.onCall(ws, msg.id, msg.name, msg.input);
+        return this.onCall(ws, msg.id, msg.name, msg.input ?? null);
       default:
         return this.send(ws, { type: "error", id: "", error: "unknown message type" });
     }
@@ -381,7 +386,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
 
   // --- live-query internals ---
 
-  private async onSubscribe(ws: WebSocket, id: string, name: string, input: unknown): Promise<void> {
+  private async onSubscribe(ws: WebSocket, id: string, name: string, input: JsonValue): Promise<void> {
     const att = this.getAttachment(ws);
     const subs = this.getSubs(ws);
     try {
@@ -402,7 +407,7 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     }
   }
 
-  private async onCall(ws: WebSocket, id: string, name: string, input: unknown): Promise<void> {
+  private async onCall(ws: WebSocket, id: string, name: string, input: JsonValue): Promise<void> {
     const att = this.getAttachment(ws);
     let outcome: Awaited<ReturnType<typeof dispatch>>;
     try {
@@ -598,13 +603,17 @@ export class PramenDOBase extends DurableObject<DoEnv> {
     // Carry the schema so any consumer of this context (not just Db) can compile
     // relation-aware `where` rules into subqueries, and the active partition so Db's
     // table-access guard rejects any table outside this DO's partition.
-    return { acl: this.acl, identity, schema: this.app.schema, partition };
+    return { acl: this.acl, identity, schema: this.app.schema, partition, tenant: this.tenant };
   }
 
   // The DO env (bindings + vars + secrets) handed to handlers as ctx.env. Loosely
   // typed at the boundary so handlers can read any var/secret without a DoEnv cast.
-  private get envBag(): Readonly<Record<string, unknown>> {
-    return this.env as unknown as Record<string, unknown>;
+  private widenedEnv: EnvBag | null = null;
+  private get envBag(): EnvBag {
+    // `this.env` is fixed for the DO's lifetime, so widen it once. This getter is read
+    // inside the per-subscription live-query loop, where a copy per read would allocate
+    // one whole binding bag per subscription on every write.
+    return (this.widenedEnv ??= { ...this.env });
   }
 
   // One Files facade per DO (a DO serves one tenant). Backed by the R2 binding;

package/src/index.ts

@@ -8,7 +8,7 @@
 // and codegen load an app.ts for its schema without dragging in the DO runtime.
 
 // --- schema authoring ---
-export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger } from "./sdk/schema";
+export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger, partitionOf, DEFAULT_PARTITION } from "./sdk/schema";
 export type { TriggerDef, TriggerOp } from "./sdk/schema";
 export { isValidUuid } from "./sdk/uuid";
 export type {
@@ -31,7 +31,7 @@ export type {
 // --- app + handlers ---
 export { createApp } from "./sdk/app";
 export { query, mutation, authorizeHandler } from "./sdk/handlers";
-export type { Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
+export type { EnvBag, Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
 
 // --- ACL ---
 export { $identity, $input, $now, allow, deny, policy, resolve, role, isAllow, isDeny, isResolver, isIdentityMarker, isInputMarker, isNowMarker } from "./sdk/acl";
@@ -64,6 +64,10 @@ export type {
   InferRow,
   InferUpdate,
   JsonValue,
+  JsonObject,
+  SqlValue,
+  CellValue,
+  Row,
   ProjectedRow,
   RelationsOf,
   RelationsResult,
@@ -78,6 +82,12 @@ export { Kv, denySession, allowSession, isSessionDenied } from "./runtime/kv";
 // --- files ---
 export type { FileRef, Files, SignUploadOpts, SignDownloadOpts, HeadResult } from "./sdk/files";
 export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runtime/storage";
+
+// Signed capability tokens (HMAC-SHA256) — the machinery behind signed file urls and
+// page-preview links. Exported so an app (or @pramen/cms) can mint its own capability url
+// without a second signing implementation.
+export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
+export type { ExpiringToken } from "./runtime/token";
 export type { StorageAdapter, PutResult, GetResult } from "./runtime/storage";
 
 // --- mail (ctx.mail) ---
@@ -91,8 +101,8 @@ export { routeQueue, dispatchQueueBatch } from "./runtime/queue-consumer";
 export type { QueueContext, QueueHandler, QueueMessage, QueueBatch, AppQueueMap } from "./runtime/queue-consumer";
 
 // --- errors ---
-export { PramenError, BadRequest, Unauthorized, Forbidden } from "./runtime/errors";
+export { PramenError, BadRequest, Unauthorized, Forbidden, Conflict } from "./runtime/errors";
 
 // --- substrate seam (advanced: bring your own SQL backend) ---
 export { sqliteDialect, postgresDialect, DoSqliteDriver, D1Driver } from "./runtime/driver";
-export type { Driver, Dialect, Row } from "./runtime/driver";
+export type { Driver, Dialect, DriverRow } from "./runtime/driver";

package/src/pramen.ts

@@ -18,12 +18,14 @@ import { validateTriggerTasks, type SchemaDef } from "./sdk/schema";
 import type { AppTaskMap, HandlerMap, BootstrapFn } from "./sdk/handlers";
 import type { AppQueueMap, QueueBatch } from "./runtime/queue-consumer";
 import type { Role } from "./sdk/acl";
+import type { EnvBag } from "./sdk/handlers";
+import type { JsonValue } from "./sdk/infer";
 
 /** Injected into a public route's handler — forward a privileged mutation into the
  * tenant's DO without the handler importing any deploy-side code (so app.ts stays
  * authoring-only). The synthetic identity defaults to the admin role. */
 export interface RouteContext {
-  callPrivileged(opts: { name: string; input?: unknown; tenant?: string; roles?: string[] }): Promise<Response>;
+  callPrivileged(opts: { name: string; input?: JsonValue; tenant?: string; roles?: string[] }): Promise<Response>;
 }
 
 /** A public, pre-auth route — matched before identity resolution, so it can host a
@@ -36,7 +38,7 @@ export interface PublicRoute {
   method: string;
   /** Exact pathname to match (e.g. "/stripe/webhook"). */
   path: string;
-  handler: (request: Request, env: Readonly<Record<string, unknown>>, ctx: RouteContext) => Response | Promise<Response>;
+  handler: (request: Request, env: EnvBag, ctx: RouteContext) => Response | Promise<Response>;
 }
 
 /** The user-facing app: a schema, the handler map, ACL roles, and optional public