lemon-core 5.0.8 → 5.0.9

package/README.md

@@ -6,7 +6,7 @@
 
 Bootloader for serverless micro-services on AWS Lambda: one function, several event sources, an engine with modules, a protocol service.
 This README is the entry point for people and AI agents; every path and command below is in this repo. `§` refers to `HOW_TO_UPGRADE_V5.md`.
-v5 status: npm `latest` is `5.0.7` (2026-10-30; same source as 5.0.6). The `v5` branch holds all 5.x work; `develop` is the default branch.
+v5 status: npm `latest` is `5.0.8` (2026-10-30; B15 + lemon-model 5.0.2). The `v5` branch holds all 5.x work; `develop` is the default branch.
 `CONTRIBUTING.md` describes the `develop` flow; 5.x changes are merged into `v5` until it lands on `develop`.
 
 ## At a glance
@@ -16,7 +16,7 @@ v5 status: npm `latest` is `5.0.7` (2026-10-30; same source as 5.0.6). The `v5`
 | Runtime | Node `>=24.0.0` (`engines.node`), `.nvmrc` `24.15.0` |
 | Build | TypeScript `^5.9.3`. `npm run build` = `build-ts` (`tsc`) + `scripts/gen-esm-wrapper.cjs` |
 | Tests | vitest `^4.1.4`: `src/**/*.spec.ts`, `bin/**/*.spec.mjs` (`vitest.config.ts`) |
-| Formats | CJS `dist/` + ESM `dist/esm/*.mjs`. `exports`: `.`, `./testing`, `./dist/environ`, `./dist/cores/lambda/lambda-web-handler`, `./dist/extended/cores`, `./dist/*` (until v6), `./package.json` |
+| Formats | CJS `dist/` + ESM `dist/esm/*.mjs`. `exports`: `.`, `./testing`, `./model` (unreleased, B16), `./dist/environ`, `./dist/cores/lambda/lambda-web-handler`, `./dist/extended/cores`, `./dist/*` (until v6), `./package.json` |
 | Dependencies | `@aws-sdk/client-dynamodb, @aws-sdk/lib-dynamodb, @opensearch-project/opensearch, @smithy/signature-v4, @types/aws-lambda, @types/jsonwebtoken, async, crypto-js, js-yaml, jsonwebtoken, lemon-model, mime-types, node-cache, qs, source-map-support` |
 | Optional peers | 8 AWS SDK packages `^3.1159.0`, loaded on first use. `typescript` `>=4.7` (CLI) |
 | Published | `files`: `dist/**/*`, `bin/lemon-fields-types.mjs`, `bin/lib/fields-types.mjs`. CLI `lemon-fields-types` (since 5.0.5; see § 13.5) |
@@ -33,7 +33,7 @@ v5 status: npm `latest` is `5.0.7` (2026-10-30; same source as 5.0.6). The `v5`
 | `src/extended/` | `CoreService`, `ManagerProxy`; `cores/`: template layer (`MyCoreService`, `checkFieldsAdmin()`) | Developer |
 | `src/controllers/`, `tools/`, `helpers/` | Controllers, `express`, `$T`, `$protocol()` | Developer |
 | `src/lib/` | Internal: `safe-json`, `log-mask`, `qs-compat`, `http-fetch`, `lazy`, `perf`. `lib` barrel: `dynamodb-value` only | Developer. Internal; never re-exported from a barrel |
-| `src/common/test-helper.ts`, `src/environ.ts` | Sub-paths `lemon-core/testing`, `lemon-core/dist/environ` | Rarely; both are published sub-paths |
+| `src/common/test-helper.ts`, `src/environ.ts`, `src/model.ts` | Sub-paths `lemon-core/testing`, `lemon-core/dist/environ`, `lemon-core/model` (B16) | Rarely; all are published sub-paths |
 | `bin/` | `lemon-fields-types` CLI, `lib/` logic, spec, fixtures | Developer |
 | `scripts/` | Build and API gates, lazy-load probes | Developer |
 | `etc/api-names.v4.txt`, `etc/api-names.allow.txt` | v4 public-name baseline; allowed `+Name`/`-Name` | The baseline stays; add lines to the allow list only |
@@ -85,6 +85,7 @@ await $lemon.engine.initialize(); // resolves once every module's initModule() s
 ```
 
 ESM `import` gives the same instances (§ 2). Specs use `lemon-core/testing` (§ 4).
+Since 5.0.9, lemon-model names that are not on the root come from `import { field, fieldsOf } from 'lemon-core/model';` — do not declare `lemon-model` yourself (§ 16).
 
 ### 3. Engine module registration — the "3-piece set"
 
@@ -171,7 +172,7 @@ npm audit --omit=dev  # found 0 vulnerabilities
 
 | Document | Content |
 |---|---|
-| [HOW_TO_UPGRADE_V5.md](HOW_TO_UPGRADE_V5.md) | § 1 Node 24 · § 2 ESM · § 3 `exports` · § 4 testing · § 5 modules · § 6 deps · § 7 OpenSearch · § 8 AWS SDK · § 9 L1/L2 · § 10 `@field()` · § 11 trust · § 12 `src/cores/` · § 13 B10 · § 14 audit · § 15 channel/relay (B14) |
+| [HOW_TO_UPGRADE_V5.md](HOW_TO_UPGRADE_V5.md) | § 1 Node 24 · § 2 ESM · § 3 `exports` · § 4 testing · § 5 modules · § 6 deps · § 7 OpenSearch · § 8 AWS SDK · § 9 L1/L2 · § 10 `@field()` · § 11 trust · § 12 `src/cores/` · § 13 B10 · § 14 audit · § 15 channel/relay (B14) · § 16 `lemon-core/model` (B16) |
 | [HOW_TO_UPGRADE_V4.md](HOW_TO_UPGRADE_V4.md) | v3 → v4 (historical) |
 | [baseline.md](docs/v5/baseline.md) | B0-a baseline: link state, boot, run modes, test counts, public names |
 | [B0-local-harness.md](docs/v5/B0-local-harness.md) | B0 local harness: the local run path as the verification gate |
@@ -202,10 +203,11 @@ npm audit --omit=dev  # found 0 vulnerabilities
 | [B14-relay-context.md](docs/v5/B14-relay-context.md) | B14 plan: `context.channel`, the signed relay `x-lemon-relay`, trace, `x-protocol-context` deprecation (Korean) |
 | [B14-relay-context-impl.md](docs/v5/B14-relay-context-impl.md) | B14 implementation record (WP1–WP3): lemon-model `channel`/`trace`, `protocol-relay.ts`, entry changes (Korean) |
 | [B15-security.md](docs/v5/B15-security.md) | B15: cross-cloud `cid`, list `view`, internal admin, policy keys `internal`/`cross` |
+| [B16-model-subpath.md](docs/v5/B16-model-subpath.md) | B16: sub-path `lemon-core/model` (all of lemon-model), exact lemon-model pin, consumer rule |
 | [docs/specs/](docs/specs/) | `$T`, `$U` characterization specs |
 | [docs/header-identity-token.md](docs/header-identity-token.md) | Identity token header |
 | [CONTRIBUTING](CONTRIBUTING.md), [SECURITY](SECURITY.md), [CODE_OF_CONDUCT](CODE_OF_CONDUCT.md) | PR process; supported versions; conduct |
-| [CHANGELOG.md](CHANGELOG.md) | 5.0.5–5.0.7 entries (B10, B13, B14), then stops at 1.2.0 (2019); see VERSION INFO |
+| [CHANGELOG.md](CHANGELOG.md) | 5.0.5–5.0.8 entries (B10, B13, B14, B15), then stops at 1.2.0 (2019); see VERSION INFO |
 
 ## Contribution
 
@@ -223,6 +225,7 @@ See [CODE_OF_CONDUCT](CODE_OF_CONDUCT.md)
 
 | Version   | Description
 |--         |--
+| 5.0.8     | B15 security follow-up (§ 11.7, § 15.2); lemon-model `^5.0.2`.
 | 5.0.7     | Re-publish of 5.0.6 (same source).
 | 5.0.6     | B13 default data-access policy of `AbstractCRUDController` (§ 11.7); B14 `context.channel`, signed relay `x-lemon-relay`, `TRACE` line, `x-protocol-context` deprecated (§ 15); README rewritten as the v5 entry point; lemon-model `^5.0.1`.
 | 5.0.5     | B10: `getHelloArn()` account (§ 13.1), circular-safe reports (§ 13.2), masked header logs (§ 13.3), enforce runbook + masked config log (§ 13.4), `lemon-fields-types` (§ 13.5); `LOCAL_TRANSPORT=mock` opt-in (§ 11.3.1).

package/dist/esm/model.mjs

@@ -0,0 +1,61 @@
+// generated by scripts/gen-esm-wrapper.cjs from dist/model.d.ts. do not edit.
+import cjs from '../model.js';
+export const $gemini = cjs.$gemini;
+export const AbstractTransformer = cjs.AbstractTransformer;
+export const BrowserWebSocketNetwork = cjs.BrowserWebSocketNetwork;
+export const CORE_FIELDS = cjs.CORE_FIELDS;
+export const CoreModel = cjs.CoreModel;
+export const DEFAULT_MAX_PACKET_BYTES = cjs.DEFAULT_MAX_PACKET_BYTES;
+export const FIELDS_KEY = cjs.FIELDS_KEY;
+export const GenAIStreamBuffer = cjs.GenAIStreamBuffer;
+export const HttpAbstractGenAI = cjs.HttpAbstractGenAI;
+export const JSONProxyTransportReceiver = cjs.JSONProxyTransportReceiver;
+export const JSONTransport = cjs.JSONTransport;
+export const JSONTransportReliableError = cjs.JSONTransportReliableError;
+export const JSON_RELIABLE_SCOPE = cjs.JSON_RELIABLE_SCOPE;
+export const MULTI_NETWORK_SCOPE = cjs.MULTI_NETWORK_SCOPE;
+export const OwnedWebSocketNetwork = cjs.OwnedWebSocketNetwork;
+export const TokenBuffer = cjs.TokenBuffer;
+export const WEBSOCKET_NETWORK_SCOPE = cjs.WEBSOCKET_NETWORK_SCOPE;
+export const asGenAIStreamNetworkTransportOptions = cjs.asGenAIStreamNetworkTransportOptions;
+export const asLegacyTokenConsumer = cjs.asLegacyTokenConsumer;
+export const asStreamConsumer = cjs.asStreamConsumer;
+export const assembleJSON = cjs.assembleJSON;
+export const browserWebSocketDumpTest = cjs.browserWebSocketDumpTest;
+export const calculateJSONTransportChunkBytes = cjs.calculateJSONTransportChunkBytes;
+export const compactStreamEvent = cjs.compactStreamEvent;
+export const createBufferProgressGauge = cjs.createBufferProgressGauge;
+export const createFilteredNetwork = cjs.createFilteredNetwork;
+export const createGenAIStreamNetworkConsumer = cjs.createGenAIStreamNetworkConsumer;
+export const createGenAIStreamNetworkReceiver = cjs.createGenAIStreamNetworkReceiver;
+export const createJSONTransport = cjs.createJSONTransport;
+export const createLogTraceConsumer = cjs.createLogTraceConsumer;
+export const createLogTraceReporter = cjs.createLogTraceReporter;
+export const createMultiSocketNetwork = cjs.createMultiSocketNetwork;
+export const createOwnedWebSocketNetwork = cjs.createOwnedWebSocketNetwork;
+export const createProgressConsumer = cjs.createProgressConsumer;
+export const createProgressReporter = cjs.createProgressReporter;
+export const createProxyTransportReceiver = cjs.createProxyTransportReceiver;
+export const createReconnectingNetwork = cjs.createReconnectingNetwork;
+export const createSocketClient = cjs.createSocketClient;
+export const createSocketClientIdentityProvider = cjs.createSocketClientIdentityProvider;
+export const createSyncMachine = cjs.createSyncMachine;
+export const createSyncTicker = cjs.createSyncTicker;
+export const createTimeProgressGauge = cjs.createTimeProgressGauge;
+export const createTranslatedNetwork = cjs.createTranslatedNetwork;
+export const defaultJSONTransportIdentityProvider = cjs.defaultJSONTransportIdentityProvider;
+export const defaultReliableJSONTransportIdentityProvider = cjs.defaultReliableJSONTransportIdentityProvider;
+export const estimateGenAIStreamSize = cjs.estimateGenAIStreamSize;
+export const extractWebSocketConnectionId = cjs.extractWebSocketConnectionId;
+export const field = cjs.field;
+export const fieldsOf = cjs.fieldsOf;
+export const isJSONReliableScope = cjs.isJSONReliableScope;
+export const mockGenAIStream = cjs.mockGenAIStream;
+export const onGenAIStreamNetworkError = cjs.onGenAIStreamNetworkError;
+export const onReliableError = cjs.onReliableError;
+export const restoreStreamEvent = cjs.restoreStreamEvent;
+export const runMockGenAIStream = cjs.runMockGenAIStream;
+export const specsOf = cjs.specsOf;
+export const splitJSON = cjs.splitJSON;
+export const summarizeJSONTransportSize = cjs.summarizeJSONTransportSize;
+export const waitWebSocketConnectionId = cjs.waitWebSocketConnectionId;

package/dist/model.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `model.ts`
+ * - sub-path `lemon-core/model`: the whole lemon-model surface, through lemon-core (v5 B16, D73).
+ * - consumers do not declare `lemon-model` themselves: the lemon-core version fixes the lemon-model version.
+ * - the root (`lemon-core`) keeps only the 32 v4 lemon-model names (S-06); every other name is here.
+ *
+ * usage:
+ * ```ts
+ * import { CoreModel } from 'lemon-core'; // root: the 32 v4 names
+ * import { field, fieldsOf } from 'lemon-core/model'; // everything else of lemon-model
+ * ```
+ *
+ * @author      Steve Jung <steve@lemoncloud.io>
+ * @date        2026-10-30 v5 B16: initial version (`export *` from lemon-model, no default export there).
+ *
+ * @copyright (C) lemoncloud.io 2026 - All Rights Reserved.
+ */
+export * from 'lemon-model';

package/dist/model.js

@@ -0,0 +1,36 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `model.ts`
+ * - sub-path `lemon-core/model`: the whole lemon-model surface, through lemon-core (v5 B16, D73).
+ * - consumers do not declare `lemon-model` themselves: the lemon-core version fixes the lemon-model version.
+ * - the root (`lemon-core`) keeps only the 32 v4 lemon-model names (S-06); every other name is here.
+ *
+ * usage:
+ * ```ts
+ * import { CoreModel } from 'lemon-core'; // root: the 32 v4 names
+ * import { field, fieldsOf } from 'lemon-core/model'; // everything else of lemon-model
+ * ```
+ *
+ * @author      Steve Jung <steve@lemoncloud.io>
+ * @date        2026-10-30 v5 B16: initial version (`export *` from lemon-model, no default export there).
+ *
+ * @copyright (C) lemoncloud.io 2026 - All Rights Reserved.
+ */
+//* v5 B16: re-export every named value and type of lemon-model (lemon-model has no default export).
+__exportStar(require("lemon-model"), exports);
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,oGAAoG;AACpG,8CAA4B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemon-core",
-  "version": "5.0.8",
+  "version": "5.0.9",
   "description": "Lemon Serverless Micro-Service Platform",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,6 +20,12 @@
       "require": "./dist/common/test-helper.js",
       "default": "./dist/common/test-helper.js"
     },
+    "./model": {
+      "types": "./dist/model.d.ts",
+      "import": "./dist/esm/model.mjs",
+      "require": "./dist/model.js",
+      "default": "./dist/model.js"
+    },
     "./dist/environ": {
       "types": "./dist/environ.d.ts",
       "import": "./dist/environ.js",
@@ -105,7 +111,7 @@
     "crypto-js": "^4.2.0",
     "js-yaml": "^4.1.1",
     "jsonwebtoken": "^9.0.3",
-    "lemon-model": "^5.0.2",
+    "lemon-model": "5.0.2",
     "mime-types": "^3.0.2",
     "node-cache": "^5.1.2",
     "qs": "^6.16.2",