@lunora/do 1.0.0-alpha.26 → 1.0.0-alpha.28

package/dist/index.d.mts

@@ -756,6 +756,15 @@ declare class ReactiveCache {
 * RLS-filtered list, or `getMyProfile()` with no args) would otherwise memoize
 * the first caller's result under an identity-independent key and serve it to
 * everyone. Anonymous/subscription callers pass `null` (their own bucket).
+*
+* The discriminator is an opaque `null | string`, NOT just a userId: the wiring
+* layer (`ShardDO#runCachedQuery`) folds the FULL resolved identity — userId
+* plus the `getIdentity()` claims (active-org / role / tenant) — into a single
+* `stableStringify`'d string before it reaches here. That matters because RLS
+* can key on a claim OTHER than userId: a multi-tenant caller whose userId is
+* stable but whose active-org claim varies request-to-request must NOT share a
+* cache entry across those requests. Encoding the whole identity, not the
+* userId alone, is what keeps those contexts isolated.
 */
 declare const reactiveCacheKey: (functionPath: string, args: Record<string, unknown>, identity: null | string) => string;
 /** The system tables `ctx.db.system` can read. */
@@ -1867,7 +1876,9 @@ interface DatabaseWriterLike {
   * since a global table has no shard boundaries to merge across.
   */
   rankPageRows?: (tableName: string, indexName: string, options?: RankPageOptions) => Promise<ShardRankPageResult>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string, options?: {
+    allowExplicitId?: boolean;
+  }) => Promise<void>;
   /**
   * Un-soft-delete a row: clears the `.softDelete()` marker column (a by-id
   * UPDATE, so it works on a row that list reads currently hide). Throws when
@@ -4344,6 +4355,8 @@ declare abstract class ShardDO {
   * cleared in the `finally` block of `fetch` like the other per-request fields.
   */
   private currentRequestIp;
+  /** W3C `traceparent` of the inbound RPC; forwarded onto outbound container fetches. */
+  private currentRequestTraceparent;
   /**
   * Client-issued idempotency key for the in-flight mutation, forwarded via the
   * `x-lunora-mutation-id` header. When set, the dispatch path dedups the call
@@ -4754,6 +4767,12 @@ declare abstract class ShardDO {
   */
   protected getCurrentIp(): string | undefined;
   /**
+  * W3C `traceparent` of the inbound RPC (forwarded by the runtime), or
+  * `undefined`. `buildCtx` passes it to `createContainerContext` so outbound
+  * container fetches carry it and the container's spans join the same trace.
+  */
+  protected getCurrentTraceparent(): string | undefined;
+  /**
   * Identity claims (email, name, roles, …) forwarded by the runtime's
   * `resolveIdentity` hook. Returns `undefined` for anonymous requests
   * or when no extra claims were attached. Use this to populate the

package/dist/index.d.ts

@@ -756,6 +756,15 @@ declare class ReactiveCache {
 * RLS-filtered list, or `getMyProfile()` with no args) would otherwise memoize
 * the first caller's result under an identity-independent key and serve it to
 * everyone. Anonymous/subscription callers pass `null` (their own bucket).
+*
+* The discriminator is an opaque `null | string`, NOT just a userId: the wiring
+* layer (`ShardDO#runCachedQuery`) folds the FULL resolved identity — userId
+* plus the `getIdentity()` claims (active-org / role / tenant) — into a single
+* `stableStringify`'d string before it reaches here. That matters because RLS
+* can key on a claim OTHER than userId: a multi-tenant caller whose userId is
+* stable but whose active-org claim varies request-to-request must NOT share a
+* cache entry across those requests. Encoding the whole identity, not the
+* userId alone, is what keeps those contexts isolated.
 */
 declare const reactiveCacheKey: (functionPath: string, args: Record<string, unknown>, identity: null | string) => string;
 /** The system tables `ctx.db.system` can read. */
@@ -1867,7 +1876,9 @@ interface DatabaseWriterLike {
   * since a global table has no shard boundaries to merge across.
   */
   rankPageRows?: (tableName: string, indexName: string, options?: RankPageOptions) => Promise<ShardRankPageResult>;
-  replace: (id: string, document: Record<string, unknown>, expectedTable?: string) => Promise<void>;
+  replace: (id: string, document: Record<string, unknown>, expectedTable?: string, options?: {
+    allowExplicitId?: boolean;
+  }) => Promise<void>;
   /**
   * Un-soft-delete a row: clears the `.softDelete()` marker column (a by-id
   * UPDATE, so it works on a row that list reads currently hide). Throws when
@@ -4344,6 +4355,8 @@ declare abstract class ShardDO {
   * cleared in the `finally` block of `fetch` like the other per-request fields.
   */
   private currentRequestIp;
+  /** W3C `traceparent` of the inbound RPC; forwarded onto outbound container fetches. */
+  private currentRequestTraceparent;
   /**
   * Client-issued idempotency key for the in-flight mutation, forwarded via the
   * `x-lunora-mutation-id` header. When set, the dispatch path dedups the call
@@ -4754,6 +4767,12 @@ declare abstract class ShardDO {
   */
   protected getCurrentIp(): string | undefined;
   /**
+  * W3C `traceparent` of the inbound RPC (forwarded by the runtime), or
+  * `undefined`. `buildCtx` passes it to `createContainerContext` so outbound
+  * container fetches carry it and the container's spans join the same trace.
+  */
+  protected getCurrentTraceparent(): string | undefined;
+  /**
   * Identity claims (email, name, roles, …) forwarded by the runtime's
   * `resolveIdentity` hook. Returns `undefined` for anonymous requests
   * or when no extra claims were attached. Use this to populate the

package/dist/index.mjs

@@ -3,13 +3,13 @@ export { AGGREGATE_SQL_FUNCTION, aggregateSqlFunction, matchesStaticWhere, norma
 export { aggregateTableName, coerceAggregateNumber, encodeAggregateKey, foldAggregateTally, readAggregateValue } from './packem_shared/aggregateTableName-CxNqY1Sl.mjs';
 export { CountRlsUnsupportedError, mergeWhere, planAggregateLookup, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy } from './packem_shared/CountRlsUnsupportedError-BGxj0pgS.mjs';
 export { AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, ensureAuthMetricsTables, readAuthMetrics, recordAuthEvent } from './packem_shared/AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-BdDLev9w.mjs';
-export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-DB3IYUR3.mjs';
+export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStructurally } from './packem_shared/NotUniqueError-BigrdT_W.mjs';
+export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
 export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-DNcvoLRT.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-BptUN8CR.mjs';
+export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-CTqZisSC.mjs';
+export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-CYkt7Ru8.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
 export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-Bxdijn66.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
@@ -22,19 +22,19 @@ export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-B
 export { serveRelationFanout } from './packem_shared/serveRelationFanout-C56hKu1O.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BXSq3S70.mjs';
-export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-G1eNK4DQ.mjs';
+export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-DTvHvRzY.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
-export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-D71QAL5h.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-CpURtawE.mjs';
+export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-CszdLJhN.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-D57CJaT9.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';
 export { ConflictError } from './packem_shared/ConflictError-CLoq37xH.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
 export { compileWhereSql } from './packem_shared/compileWhereSql-DE6yfRcQ.mjs';
-export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DZSVKRr7.mjs';
+export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DjJEHiM2.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-DDoT-UUI.mjs';
-export { runShardMigrations } from './packem_shared/runShardMigrations-DeZr0KZp.mjs';
+export { runShardMigrations } from './packem_shared/runShardMigrations-BGx4v2B6.mjs';
 export { stableStringify } from './packem_shared/stableStringify-MydiuScU.mjs';
 export { s as subscriptionListDeltas } from './packem_shared/subscription-delivery-CK8qga-k.mjs';

package/dist/packem_shared/{CDC_LOG_TABLE-DZSVKRr7.mjs → CDC_LOG_TABLE-DjJEHiM2.mjs}

@@ -95,7 +95,7 @@ const applyCdcChange = async (writer, change) => {
         fields[key] = value;
       }
     }
-    await writer.replace(change.id, fields);
+    await writer.replace(change.id, fields, void 0, { allowExplicitId: true });
   }
 };
 const applyCdcChanges = async (writer, changes) => {

package/dist/packem_shared/{DATA_MIGRATION_STATE_TABLE-DB3IYUR3.mjs → DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs}

@@ -178,7 +178,9 @@ const runDataMigration = async (options) => {
         if (next !== void 0) {
           changed += 1;
           if (!dryRun) {
-            await writer.replace(String(document["_id"]), { ...next, _creationTime: document["_creationTime"], _id: document["_id"] });
+            await writer.replace(String(document["_id"]), { ...next, _creationTime: document["_creationTime"], _id: document["_id"] }, void 0, {
+              allowExplicitId: true
+            });
           }
         }
         if (!dryRun) {

package/dist/packem_shared/{NotUniqueError-BdDLev9w.mjs → NotUniqueError-BigrdT_W.mjs}

@@ -3,8 +3,8 @@ import { sql } from 'drizzle-orm';
 import { matchesStaticWhere, aggregateSqlFunction, normalizeCountArgument, throwingScheduler } from './AGGREGATE_SQL_FUNCTION-CQsu2Xga.mjs';
 import { encodeAggregateKey, foldAggregateTally, aggregateTableName, coerceAggregateNumber, readAggregateValue } from './aggregateTableName-CxNqY1Sl.mjs';
 import { mergeWhere, CountRlsUnsupportedError, selectIndexForGroupBy, selectIndexForCount, selectIndexForAggregate } from './CountRlsUnsupportedError-BGxj0pgS.mjs';
-import { appendCdcChange } from './CDC_LOG_TABLE-DZSVKRr7.mjs';
-export { CDC_LOG_TABLE, applyCdcChanges, bumpCdcEpoch, minCdcSeq, readCdcChanges, readCdcCursor, readCdcEpoch, trimCdcChanges } from './CDC_LOG_TABLE-DZSVKRr7.mjs';
+import { appendCdcChange } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
+export { CDC_LOG_TABLE, applyCdcChanges, bumpCdcEpoch, minCdcSeq, readCdcChanges, readCdcCursor, readCdcEpoch, trimCdcChanges } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
 import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
 import { i as isFtsAvailable, D as DOC_COLUMN$1, r as rowToDocument, A as AGG_KEY, a as AGG_VALUE, b as AGG_COUNT, d as aggUpsertSql, j as jsonPathSql, q as quoteIdentifier, t as tableColumns, e as qualifiedJsonPathSql } from './do-sql-BCHCWtrD.mjs';
 import { param } from './renderSql-D6eUcn2N.mjs';
@@ -16,14 +16,14 @@ import { decodeCursor, normalizeOrderKeys, buildSeekWhere, applySelect, encodeCu
 import NotFoundError from './NotFoundError-C70b9hLw.mjs';
 import { assertFlatPredicate, resolveRelationPredicates } from './DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 import { runRowValidators, resolveWith, applyOnDelete, fanOutScalarCounts } from './applyOnDelete-BXSq3S70.mjs';
-import { guardWriter } from './RLS_UNWRAP_SYMBOL-G1eNK4DQ.mjs';
+import { guardWriter } from './RLS_UNWRAP_SYMBOL-DTvHvRzY.mjs';
 import { createSystemReader } from './createSystemReader-D12eNH13.mjs';
 import { ConflictError } from './ConflictError-CLoq37xH.mjs';
 import { runTriggers } from './hasTrigger-5N6_Fx0A.mjs';
 import { compileWhereSql } from './compileWhereSql-DE6yfRcQ.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './backfillAggregateIndexes-DDoT-UUI.mjs';
 export { C as CLIENT_WATERMARK_TABLE, G as GLOBAL_SHAPE_SNAPSHOT_TABLE, I as IDEMPOTENCY_TABLE, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, e as deleteGlobalShapeSnapshotsForConnection, m as migrateClientWatermark, b as migrateGlobalShapeSnapshot, r as readClientWatermark, f as readGlobalShapeSnapshot, g as readIdempotent, t as trimIdempotent, w as writeGlobalShapeSnapshot, h as writeIdempotent } from './ctx-db-idempotency-BdcNpvY4.mjs';
-export { runShardMigrations } from './runShardMigrations-DeZr0KZp.mjs';
+export { runShardMigrations } from './runShardMigrations-BGx4v2B6.mjs';
 export { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-Cz9dHyh1.mjs';
 
 const rankIndexFieldsUnchanged = (index, previous, next) => {
@@ -1574,7 +1574,7 @@ const createShardCtxDb = (options) => {
       } else {
         id = generateId();
       }
-      const creationTime = typeof withDefaults["_creationTime"] === "number" ? withDefaults["_creationTime"] : clock();
+      const creationTime = insertOptions?.allowExplicitId && typeof withDefaults["_creationTime"] === "number" ? withDefaults["_creationTime"] : clock();
       const documentWithMeta = { ...withDefaults, _creationTime: creationTime, _id: id };
       if (hasMatchingTrigger(tableName, "before", "insert")) {
         await fireTriggers("before", "insert", { doc: { ...documentWithMeta }, id, op: "insert", table: tableName });
@@ -1617,7 +1617,7 @@ const createShardCtxDb = (options) => {
       const rows = documents.map((document) => {
         const withDefaults = applyInsertDefaults(definition, document, auth);
         const id = batchOptions?.allowExplicitId === true && typeof withDefaults["_id"] === "string" ? withDefaults["_id"] : generateId();
-        const creationTime = typeof withDefaults["_creationTime"] === "number" ? withDefaults["_creationTime"] : clock();
+        const creationTime = batchOptions?.allowExplicitId === true && typeof withDefaults["_creationTime"] === "number" ? withDefaults["_creationTime"] : clock();
         return { creationTime, document: { ...withDefaults, _creationTime: creationTime, _id: id }, id };
       });
       const valuesSql = sql.join(
@@ -1847,12 +1847,12 @@ const createShardCtxDb = (options) => {
         syncRanks(located.tableName, id, void 0, located.row);
       }
     },
-    async replace(id, document, expectedTable) {
+    async replace(id, document, expectedTable, replaceOptions) {
       const located = locateRowById(id, expectedTable);
       if (!located) {
         const global = expectedTable === void 0 ? globalFallback() : void 0;
         if (global) {
-          await global.replace(id, document);
+          await global.replace(id, document, void 0, replaceOptions);
           return;
         }
         throw new LunoraError("INTERNAL", `document not found: ${id}`);
@@ -1863,7 +1863,7 @@ const createShardCtxDb = (options) => {
         throw new LunoraError("INTERNAL", `unknown table: ${tableName}`);
       }
       assertNoExplicitUndefined("replace", document);
-      const creationTime = typeof document["_creationTime"] === "number" ? document["_creationTime"] : clock();
+      const creationTime = replaceOptions?.allowExplicitId && typeof document["_creationTime"] === "number" ? document["_creationTime"] : clock();
       const replaced = { ...document, _creationTime: creationTime, _id: id };
       applyOnUpdate(tableDefinition, document, replaced, auth);
       runRowValidators(tableDefinition, replaced);

package/dist/packem_shared/{RLS_UNWRAP_SYMBOL-G1eNK4DQ.mjs → RLS_UNWRAP_SYMBOL-DTvHvRzY.mjs}

@@ -120,9 +120,9 @@ const guardWriter = (raw, schema, tableOfId) => {
       guardTable(tableName);
       return base.rankPage(tableName, indexName, options);
     },
-    replace: async (id, document, expectedTable) => {
+    replace: async (id, document, expectedTable, options) => {
       await guardById(id, expectedTable);
-      return base.replace(id, document, expectedTable);
+      return base.replace(id, document, expectedTable, options);
     },
     restore: async (id, expectedTable) => {
       await guardById(id, expectedTable);

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-CpURtawE.mjs → ROOT_DO_SIZE_WARN_BYTES-CszdLJhN.mjs}

@@ -1,10 +1,11 @@
 import { LunoraError, toErrorBody } from '@lunora/errors';
 import { drizzle } from 'drizzle-orm/durable-sqlite';
+import { c as constantTimeEqual } from './constant-time-equal-BVRWZgES.mjs';
 import { j as jsonResponse } from './json-response-BdbtpOhm.mjs';
 import { e as encodeWire, a as awaitWsDrain, t as trySendFrame, d as decodeWire, s as subscriptionListDeltas, b as sendDeltaFrames } from './subscription-delivery-CK8qga-k.mjs';
 import { parseExportShardArgs, parseImportShardArgs } from './exportShardRows-Dy3oFZ26.mjs';
 import { recordAuthEvent, readAuthMetrics } from './AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
-import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-DB3IYUR3.mjs';
+import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 import { SCAN_DEP, createDependencyTracker, tableFromDepKey } from './SCAN_DEP-DLJF8dsj.mjs';
 import { readFunctionMetricsTotals, readFunctionMetricIndexHits, recordFunctionMetric, mergeScanAttribution, readFunctionMetrics, readFunctionMetricBuckets } from './FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
 import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-Bxdijn66.mjs';
@@ -18,7 +19,7 @@ import { i as isDevEnvironment, c as buildSettings, b as buildSecurityAudit } fr
 import { runReadonlySql } from './MAX_SQL_ROWS-D57CJaT9.mjs';
 import { ConflictError } from './ConflictError-CLoq37xH.mjs';
 import { e as deleteGlobalShapeSnapshotsForConnection, g as readIdempotent, h as writeIdempotent, t as trimIdempotent, r as readClientWatermark, m as migrateClientWatermark, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, f as readGlobalShapeSnapshot, w as writeGlobalShapeSnapshot } from './ctx-db-idempotency-BdcNpvY4.mjs';
-import { CDC_LOG_TABLE, readCdcChanges, readCdcCursor, readCdcEpoch, minCdcSeq, bumpCdcEpoch } from './CDC_LOG_TABLE-DZSVKRr7.mjs';
+import { CDC_LOG_TABLE, readCdcChanges, readCdcCursor, readCdcEpoch, minCdcSeq, bumpCdcEpoch } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
 import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-Cz9dHyh1.mjs';
 
 const MAX_BATCH_ENTRIES = 500;
@@ -399,18 +400,6 @@ const relaySecretOf = (env) => {
   const value = env?.[RELAY_SECRET_KEY];
   return typeof value === "string" && value.length > 0 ? value : void 0;
 };
-const constantTimeEqual$1 = (a, b) => {
-  if (a.length !== b.length) {
-    return false;
-  }
-  let mismatch = 0;
-  for (let index = 0; index < a.length; index += 1) {
-    const charA = a.charCodeAt(index);
-    const charB = b.charCodeAt(index);
-    mismatch |= charA ^ charB;
-  }
-  return mismatch === 0;
-};
 const signRelayBody = async (secret, body) => {
   const encoder = new TextEncoder();
   const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
@@ -463,7 +452,7 @@ class RelayLink {
     if (secret !== void 0) {
       const supplied = request.headers.get(RELAY_SIGNATURE_HEADER);
       const expected = await signRelayBody(secret, raw);
-      if (supplied === null || !constantTimeEqual$1(supplied, expected)) {
+      if (supplied === null || !constantTimeEqual(supplied, expected)) {
         return new Response("forbidden", { status: 403 });
       }
     }
@@ -1894,16 +1883,6 @@ const extractBearerToken = (authorization) => {
   const value = rest.join(" ").trim();
   return value.length > 0 ? value : void 0;
 };
-const constantTimeEqual = (a, b) => {
-  const max = Math.max(a.length, b.length);
-  let diff = a.length ^ b.length;
-  for (let index = 0; index < max; index += 1) {
-    const charA = index < a.length ? a.charCodeAt(index) : 0;
-    const charB = index < b.length ? b.charCodeAt(index) : 0;
-    diff |= charA ^ charB;
-  }
-  return diff === 0;
-};
 class ShardDO {
   /**
    * Per-socket cap on concurrent stream iterators. Each in-flight stream
@@ -2038,6 +2017,8 @@ class ShardDO {
    * cleared in the `finally` block of `fetch` like the other per-request fields.
    */
   currentRequestIp;
+  /** W3C `traceparent` of the inbound RPC; forwarded onto outbound container fetches. */
+  currentRequestTraceparent;
   /**
    * Client-issued idempotency key for the in-flight mutation, forwarded via the
    * `x-lunora-mutation-id` header. When set, the dispatch path dedups the call
@@ -2356,6 +2337,7 @@ class ShardDO {
     this.currentRequestIdentity = parseIdentityHeader(request.headers.get("x-lunora-identity"));
     this.currentRequestIp = request.headers.get("x-lunora-client-ip") ?? void 0;
     this.currentRequestSystem = request.headers.get("x-lunora-system") === "1";
+    this.currentRequestTraceparent = request.headers.get("traceparent") ?? void 0;
     this.currentRequestReadTables = void 0;
     this.currentRequestCacheHit = void 0;
     this.metrics.requests += 1;
@@ -2422,6 +2404,7 @@ class ShardDO {
       this.currentRequestIdentity = void 0;
       this.currentRequestIp = void 0;
       this.currentRequestSystem = false;
+      this.currentRequestTraceparent = void 0;
       this.currentScannedTables = void 0;
       this.currentIndexHits = void 0;
       this.currentRequestReadTables = void 0;
@@ -2840,6 +2823,14 @@ class ShardDO {
   getCurrentIp() {
     return this.currentRequestIp;
   }
+  /**
+   * W3C `traceparent` of the inbound RPC (forwarded by the runtime), or
+   * `undefined`. `buildCtx` passes it to `createContainerContext` so outbound
+   * container fetches carry it and the container's spans join the same trace.
+   */
+  getCurrentTraceparent() {
+    return this.currentRequestTraceparent;
+  }
   /**
    * Identity claims (email, name, roles, …) forwarded by the runtime's
    * `resolveIdentity` hook. Returns `undefined` for anonymous requests
@@ -3809,8 +3800,17 @@ class ShardDO {
     const tracker = createDependencyTracker();
     this.currentTracker = tracker;
     const hitsBefore = this.reactiveCache.stats().hits;
+    const userId = this.getCurrentUserId();
+    const claims = this.getCurrentIdentity();
+    const identity = userId === void 0 && claims === void 0 ? (
+      // eslint-disable-next-line unicorn/no-null -- reactiveCacheKey's identity arg is `null | string`; null is the documented "anonymous caller" discriminator
+      null
+    ) : (
+      // eslint-disable-next-line unicorn/no-null -- fold userId/claims into the discriminator; missing fields serialize as null so the shape stays canonical
+      stableStringify({ claims: claims ?? null, userId: userId ?? null })
+    );
     try {
-      const result = await this.reactiveCache.run(reactiveCacheKey(functionPath, args, this.getCurrentUserId() ?? null), tracker.collect(), run);
+      const result = await this.reactiveCache.run(reactiveCacheKey(functionPath, args, identity), tracker.collect(), run);
       this.currentRequestCacheHit = this.reactiveCache.stats().hits > hitsBefore;
       this.currentRequestReadTables = tablesFromDeps(tracker.collect());
       return result;

package/dist/packem_shared/{SESSION_DO_TTL_DEFAULT-D71QAL5h.mjs → SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs}

@@ -1,3 +1,4 @@
+import { c as constantTimeEqual } from './constant-time-equal-BVRWZgES.mjs';
 import { j as jsonResponse } from './json-response-BdbtpOhm.mjs';
 
 const SESSION_DO_TTL_DEFAULT = 7 * 24 * 60 * 60;
@@ -9,16 +10,6 @@ const SESSION_TOKEN_PATTERN = /^[\w-]+$/;
 const MIN_TOKEN_LENGTH = 32;
 const MAX_TOKEN_LENGTH = 256;
 const MAX_USER_ID_LENGTH = 256;
-const constantTimeEqual = (a, b) => {
-  const max = Math.max(a.length, b.length);
-  let diff = a.length ^ b.length;
-  for (let index = 0; index < max; index += 1) {
-    const charA = index < a.length ? a.charCodeAt(index) : 0;
-    const charB = index < b.length ? b.charCodeAt(index) : 0;
-    diff |= charA ^ charB;
-  }
-  return diff === 0;
-};
 const isAuthorized = (request, env) => {
   const expected = env.SESSION_DO_SECRET;
   if (typeof expected !== "string" || expected.length === 0) {

package/dist/packem_shared/constant-time-equal-BVRWZgES.mjs

@@ -0,0 +1,12 @@
+const constantTimeEqual = (a, b) => {
+  const max = Math.max(a.length, b.length);
+  let diff = a.length ^ b.length;
+  for (let index = 0; index < max; index += 1) {
+    const charA = index < a.length ? a.charCodeAt(index) : 0;
+    const charB = index < b.length ? b.charCodeAt(index) : 0;
+    diff |= charA ^ charB;
+  }
+  return diff === 0;
+};
+
+export { constantTimeEqual as c };

package/dist/packem_shared/{isSourceDue-BptUN8CR.mjs → isSourceDue-CYkt7Ru8.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { runExternalSourceTick } from './materializeExternalRows-DNcvoLRT.mjs';
+import { runExternalSourceTick } from './materializeExternalRows-CTqZisSC.mjs';
 
 const liftSourceId = (row, options = {}) => {
   const { idColumn = "id", map } = options;

package/dist/packem_shared/{materializeExternalRows-DNcvoLRT.mjs → materializeExternalRows-CTqZisSC.mjs}

@@ -1,4 +1,4 @@
-import { applyCdcChanges } from './CDC_LOG_TABLE-DZSVKRr7.mjs';
+import { applyCdcChanges } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
 import { s as selectShapeRows } from './ctx-db-shapes-Cz9dHyh1.mjs';
 import { diffExternalSource, projectExternalSourceRow } from './diffExternalSource-Cx9HUPJj.mjs';
 import { stableStringify } from './stableStringify-MydiuScU.mjs';

package/dist/packem_shared/{runShardMigrations-DeZr0KZp.mjs → runShardMigrations-BGx4v2B6.mjs}

@@ -1,6 +1,6 @@
 import { sql } from 'drizzle-orm';
 import { aggregateTableName } from './aggregateTableName-CxNqY1Sl.mjs';
-import { migrateCdcLog, migrateCdcMeta } from './CDC_LOG_TABLE-DZSVKRr7.mjs';
+import { migrateCdcLog, migrateCdcMeta } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
 import { m as migrateClientWatermark, a as migrateIdempotency, b as migrateGlobalShapeSnapshot } from './ctx-db-idempotency-BdcNpvY4.mjs';
 import { r as runDrizzle } from './do-exec-5eQy5cEi.mjs';
 import { D as DOC_COLUMN, j as jsonPathSql, c as createIndexSql, t as tableColumns, i as isFtsAvailable, A as AGG_KEY, a as AGG_VALUE, b as AGG_COUNT } from './do-sql-BCHCWtrD.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.26",
+  "version": "1.0.0-alpha.28",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
+    "@lunora/errors": "1.0.0-alpha.4",
     "@visulima/redact": "3.0.0",
     "drizzle-orm": "^0.45.2"
   },