@lunora/do 1.0.0-alpha.29 → 1.0.0-alpha.30

package/dist/index.d.mts

@@ -2531,6 +2531,7 @@ declare const ADMIN_FUNCTIONS: {
   readonly getCapturedMail: "__lunora_admin__:getCapturedMail";
   readonly getFanoutMetrics: "__lunora_admin__:getFanoutMetrics";
   readonly getFunctionStats: "__lunora_admin__:getFunctionStats";
+  readonly getIssues: "__lunora_admin__:getIssues";
   readonly listSubscriptions: "__lunora_admin__:listSubscriptions";
   readonly listTableIndexes: "__lunora_admin__:listTableIndexes";
   readonly getLogs: "__lunora_admin__:getLogs";
@@ -3346,10 +3347,14 @@ type LogLevel = "debug" | "error" | "info" | "warn";
 /**
 * One buffered log line. `functionPath` is the RPC that produced it (when the
 * entry came from the RPC dispatch site); `timestamp` is `Date.now()` at the
-* moment it was pushed.
+* moment it was pushed. `instance`/`exitCode` are populated for container
+* lifecycle entries: `instance` correlates the per-instance Durable Object id,
+* `exitCode` carries the process exit code parsed out of a `stop` event.
 */
 interface LogEntry {
+  exitCode?: number;
   functionPath?: string;
+  instance?: string;
   level: LogLevel;
   message: string;
   timestamp: number;
@@ -5589,6 +5594,14 @@ declare abstract class ShardDO {
   * the panel renders it alongside `ctx.log` lines. Admin-gated by
   * `handleAdminRpc`'s caller (the same `LUNORA_ADMIN_TOKEN` bearer as every
   * other admin write).
+  *
+  * An `error`-level lifecycle event (a crash/`onError`, or a non-zero-exit
+  * `stop`) is ALSO appended as an `error`-outcome row to the durable
+  * `__lunora_reqlog__` — the same readout `getIssues` groups over — so a
+  * crash-looping container folds into the Issues list right beside Worker
+  * errors (they share the `fingerprintError` hash over `functionPath ::
+  * bucket(message)`). The in-memory buffer stays the live Logs feed; the
+  * durable row is what survives hibernation for triage.
   */
   private handleRecordContainerEvent;
   /**
@@ -5777,6 +5790,25 @@ declare abstract class ShardDO {
   */
   private recordRequestLog;
   /**
+  * The single durable-row + Logpush write seam for `__lunora_reqlog__`. Both
+  * the per-dispatch {@link recordRequestLog} and the container-crash path
+  * ({@link handleRecordContainerEvent}) funnel through here so they can't
+  * drift — before this was extracted the container writer persisted the row
+  * but silently skipped the Logpush emit every other error got.
+  *
+  * Best-effort by contract: a SQL failure (e.g. a test double with no `sql`
+  * handle) or a serialization hiccup in the emit must NEVER turn a served
+  * request — or a container event push — into a failed one, so each half is
+  * swallowed independently.
+  *
+  * Errors are always streamed to `console` (rare, high-value — they ride CF
+  * Workers Logs at error level and the dev-server formats them in the
+  * terminal), redacted in prod like any other event. The full per-dispatch
+  * summary stream (successful OKs too) stays opt-in behind
+  * `LUNORA_REQUEST_LOG_EMIT` so a hot shard doesn't emit a line per call.
+  */
+  private persistRequestLog;
+  /**
   * Resolve the request-log knobs from the Worker `env`, all PLAN3 §3.3 decisions.
   *
   * `captureRaw`: raw (un-redacted) args/identity in a dev environment, redacted
@@ -5910,6 +5942,18 @@ declare abstract class ShardDO {
   */
   private readAdminRequestLog;
   /**
+  * Resolve a `getIssues` admin read: fold the recent `error`-outcome
+  * request-log rows into grouped {@link readErrorIssues Issues} by fingerprint,
+  * accepting the same optional correlation filters as `getRequestLog`
+  * (function-path prefix, exact shardKey/userId) plus a `limit` on rows
+  * scanned. This is a read over the bounded reqlog readout — no new store —
+  * so a self-hosted worker gets grouped error triage for free. Carries the
+  * {@link ADMIN_WILDCARD} like the other log reads so a live Issues
+  * subscription re-runs on every write-flush (the per-socket JSON memo still
+  * suppresses byte-identical pushes).
+  */
+  private readAdminIssues;
+  /**
   * Resolve a `getAuthMetrics` admin read: the durable app-level auth
   * attempt/failure counters + minute-bucketed history the studio SLO panel
   * charts (PLAN3 §2.3). Auth runs as a top-level `/api/auth/*` worker route,

package/dist/index.d.ts

@@ -2531,6 +2531,7 @@ declare const ADMIN_FUNCTIONS: {
   readonly getCapturedMail: "__lunora_admin__:getCapturedMail";
   readonly getFanoutMetrics: "__lunora_admin__:getFanoutMetrics";
   readonly getFunctionStats: "__lunora_admin__:getFunctionStats";
+  readonly getIssues: "__lunora_admin__:getIssues";
   readonly listSubscriptions: "__lunora_admin__:listSubscriptions";
   readonly listTableIndexes: "__lunora_admin__:listTableIndexes";
   readonly getLogs: "__lunora_admin__:getLogs";
@@ -3346,10 +3347,14 @@ type LogLevel = "debug" | "error" | "info" | "warn";
 /**
 * One buffered log line. `functionPath` is the RPC that produced it (when the
 * entry came from the RPC dispatch site); `timestamp` is `Date.now()` at the
-* moment it was pushed.
+* moment it was pushed. `instance`/`exitCode` are populated for container
+* lifecycle entries: `instance` correlates the per-instance Durable Object id,
+* `exitCode` carries the process exit code parsed out of a `stop` event.
 */
 interface LogEntry {
+  exitCode?: number;
   functionPath?: string;
+  instance?: string;
   level: LogLevel;
   message: string;
   timestamp: number;
@@ -5589,6 +5594,14 @@ declare abstract class ShardDO {
   * the panel renders it alongside `ctx.log` lines. Admin-gated by
   * `handleAdminRpc`'s caller (the same `LUNORA_ADMIN_TOKEN` bearer as every
   * other admin write).
+  *
+  * An `error`-level lifecycle event (a crash/`onError`, or a non-zero-exit
+  * `stop`) is ALSO appended as an `error`-outcome row to the durable
+  * `__lunora_reqlog__` — the same readout `getIssues` groups over — so a
+  * crash-looping container folds into the Issues list right beside Worker
+  * errors (they share the `fingerprintError` hash over `functionPath ::
+  * bucket(message)`). The in-memory buffer stays the live Logs feed; the
+  * durable row is what survives hibernation for triage.
   */
   private handleRecordContainerEvent;
   /**
@@ -5777,6 +5790,25 @@ declare abstract class ShardDO {
   */
   private recordRequestLog;
   /**
+  * The single durable-row + Logpush write seam for `__lunora_reqlog__`. Both
+  * the per-dispatch {@link recordRequestLog} and the container-crash path
+  * ({@link handleRecordContainerEvent}) funnel through here so they can't
+  * drift — before this was extracted the container writer persisted the row
+  * but silently skipped the Logpush emit every other error got.
+  *
+  * Best-effort by contract: a SQL failure (e.g. a test double with no `sql`
+  * handle) or a serialization hiccup in the emit must NEVER turn a served
+  * request — or a container event push — into a failed one, so each half is
+  * swallowed independently.
+  *
+  * Errors are always streamed to `console` (rare, high-value — they ride CF
+  * Workers Logs at error level and the dev-server formats them in the
+  * terminal), redacted in prod like any other event. The full per-dispatch
+  * summary stream (successful OKs too) stays opt-in behind
+  * `LUNORA_REQUEST_LOG_EMIT` so a hot shard doesn't emit a line per call.
+  */
+  private persistRequestLog;
+  /**
   * Resolve the request-log knobs from the Worker `env`, all PLAN3 §3.3 decisions.
   *
   * `captureRaw`: raw (un-redacted) args/identity in a dev environment, redacted
@@ -5910,6 +5942,18 @@ declare abstract class ShardDO {
   */
   private readAdminRequestLog;
   /**
+  * Resolve a `getIssues` admin read: fold the recent `error`-outcome
+  * request-log rows into grouped {@link readErrorIssues Issues} by fingerprint,
+  * accepting the same optional correlation filters as `getRequestLog`
+  * (function-path prefix, exact shardKey/userId) plus a `limit` on rows
+  * scanned. This is a read over the bounded reqlog readout — no new store —
+  * so a self-hosted worker gets grouped error triage for free. Carries the
+  * {@link ADMIN_WILDCARD} like the other log reads so a live Issues
+  * subscription re-runs on every write-flush (the per-socket JSON memo still
+  * suppresses byte-identical pushes).
+  */
+  private readAdminIssues;
+  /**
   * Resolve a `getAuthMetrics` admin read: the durable app-level auth
   * attempt/failure counters + minute-bucketed history the studio SLO panel
   * charts (PLAN3 §2.3). Auth runs as a top-level `/api/auth/*` worker route,

package/dist/index.mjs

@@ -11,7 +11,7 @@ export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.
 export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-CTqZisSC.mjs';
 export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-CYkt7Ru8.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-Bxdijn66.mjs';
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-CAHLZMj8.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
 export { MAIL_RETENTION, MAIL_TABLE, clearCapturedMail, ensureMailTable, readCapturedMail, recordCapturedMail } from './packem_shared/MAIL_RETENTION-CPpgl-dX.mjs';
 export { default as NotFoundError } from './packem_shared/NotFoundError-C70b9hLw.mjs';
@@ -19,14 +19,14 @@ export { armRestore, readBookmark } from './packem_shared/armRestore-4Px61hHS.mj
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-WQY8m62C.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
 export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
-export { serveRelationFanout } from './packem_shared/serveRelationFanout-C56hKu1O.mjs';
+export { serveRelationFanout } from './packem_shared/serveRelationFanout-BgaNg3Hu.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BXSq3S70.mjs';
 export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_shared/RLS_UNWRAP_SYMBOL-DTvHvRzY.mjs';
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-CJLKsAHN.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BA8QOChj.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-D57CJaT9.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';

package/dist/packem_shared/{ADMIN_FUNCTIONS-Bxdijn66.mjs → ADMIN_FUNCTIONS-CAHLZMj8.mjs}

@@ -23,6 +23,7 @@ const ADMIN_FUNCTIONS = {
   getCapturedMail: "__lunora_admin__:getCapturedMail",
   getFanoutMetrics: "__lunora_admin__:getFanoutMetrics",
   getFunctionStats: "__lunora_admin__:getFunctionStats",
+  getIssues: "__lunora_admin__:getIssues",
   listSubscriptions: "__lunora_admin__:listSubscriptions",
   listTableIndexes: "__lunora_admin__:listTableIndexes",
   getLogs: "__lunora_admin__:getLogs",

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-CJLKsAHN.mjs → ROOT_DO_SIZE_WARN_BYTES-BA8QOChj.mjs}

@@ -8,12 +8,13 @@ import { recordAuthEvent, readAuthMetrics } from './AUTH_METRICS_BUCKETS_TABLE-C
 import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 import { SCAN_DEP, createDependencyTracker, tableFromDepKey } from './SCAN_DEP-DLJF8dsj.mjs';
 import { readFunctionMetricsTotals, readFunctionMetricIndexHits, recordFunctionMetric, mergeScanAttribution, readFunctionMetrics, readFunctionMetricBuckets } from './FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
-import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-Bxdijn66.mjs';
+import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, selectMatchingIds, ADMIN_FUNCTIONS, findStorageReferences, listTables, summarizeSubscriptions, summarizeFanoutTopics, readTablePage, facetColumn, FLAGS_FUNCTION_PREFIX, recordFanoutPass, MAX_PAGE_SIZE } from './ADMIN_FUNCTIONS-CAHLZMj8.mjs';
 import { LogBuffer } from './LogBuffer-B_Ezju_N.mjs';
 import { recordCapturedMail, clearCapturedMail, readCapturedMail, MAIL_TABLE } from './MAIL_RETENTION-CPpgl-dX.mjs';
 import { readBookmark, armRestore } from './armRestore-4Px61hHS.mjs';
 import { ReactiveCache, reactiveCacheKey } from './ReactiveCache-BYlSGY0N.mjs';
 import { stableStringify } from './stableStringify-MydiuScU.mjs';
+import { fingerprintError } from '@lunora/fingerprint';
 import { redact, standardRules } from '@visulima/redact';
 import { i as isDevEnvironment, c as buildSettings, b as buildSecurityAudit } from './security-audit-CucgBice.mjs';
 import { runReadonlySql } from './MAX_SQL_ROWS-D57CJaT9.mjs';
@@ -1291,6 +1292,52 @@ const readRequestLog = (sql, options = {}) => {
     return base;
   });
 };
+const readErrorIssues = (sql, options = {}) => {
+  ensureRequestLogTable(sql);
+  const limit = Math.max(1, Math.min(options.limit ?? REQUEST_LOG_RETENTION, 1e4));
+  const conjuncts = ["outcome = 'error'"];
+  const parameters = [];
+  if (options.functionPathPrefix !== void 0 && options.functionPathPrefix !== "") {
+    conjuncts.push(String.raw`function_path LIKE ? ESCAPE '\'`);
+    parameters.push(`${escapeLike(options.functionPathPrefix)}%`);
+  }
+  if (options.userId !== void 0 && options.userId !== "") {
+    conjuncts.push("user_id = ?");
+    parameters.push(options.userId);
+  }
+  if (options.shardKey !== void 0 && options.shardKey !== "") {
+    conjuncts.push("shard_key = ?");
+    parameters.push(options.shardKey);
+  }
+  parameters.push(limit);
+  const rows = runSql(
+    sql,
+    `SELECT function_path, error_message, ts
+         FROM "${REQUEST_LOG_TABLE}" WHERE ${conjuncts.join(" AND ")} ORDER BY seq DESC LIMIT ?`,
+    ...parameters
+  ).toArray();
+  const issues = /* @__PURE__ */ new Map();
+  const sampleTs = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const message = row.error_message ?? "";
+    const { culprit, hash, title } = fingerprintError({ functionPath: row.function_path, message });
+    const existing = issues.get(hash);
+    if (existing === void 0) {
+      issues.set(hash, { count: 1, culprit, firstSeen: row.ts, hash, lastSeen: row.ts, sampleMessage: message, title });
+      sampleTs.set(hash, row.ts);
+      continue;
+    }
+    existing.count += 1;
+    existing.firstSeen = Math.min(existing.firstSeen, row.ts);
+    existing.lastSeen = Math.max(existing.lastSeen, row.ts);
+    if (row.ts > (sampleTs.get(hash) ?? Number.NEGATIVE_INFINITY)) {
+      sampleTs.set(hash, row.ts);
+      existing.sampleMessage = message;
+      existing.title = title;
+    }
+  }
+  return [...issues.values()].toSorted((a, b) => b.lastSeen - a.lastSeen);
+};
 
 const runSocketPool = async (items, processOne, concurrency = 8) => {
   let cursor = 0;
@@ -1516,6 +1563,7 @@ const parseRecordAuthEventArgs = (args) => {
   }
   return { outcome };
 };
+const CONTAINER_EXIT_CODE_PATTERN = /\(exit (\d+)\)/;
 const parseRecordContainerEventArgs = (args) => {
   const raw = args["event"];
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
@@ -1530,8 +1578,13 @@ const parseRecordContainerEventArgs = (args) => {
   const level = envelope["level"] === "error" ? "error" : "info";
   const detail = typeof envelope["message"] === "string" ? envelope["message"] : void 0;
   const timestamp = typeof envelope["ts"] === "number" ? envelope["ts"] : Date.now();
+  const instance = typeof envelope["instance"] === "string" && envelope["instance"] !== "" ? envelope["instance"] : void 0;
+  const exitRaw = detail === void 0 ? void 0 : CONTAINER_EXIT_CODE_PATTERN.exec(detail)?.[1];
+  const exitCode = exitRaw === void 0 ? void 0 : Number.parseInt(exitRaw, 10);
   return {
+    exitCode,
     functionPath: `container:${container}`,
+    instance,
     level,
     message: detail === void 0 || detail === "" ? event : `${event}: ${detail}`,
     timestamp
@@ -2391,6 +2444,8 @@ class ShardDO {
         message,
         timestamp: Date.now()
       });
+      this.recordChangedTable(REQUEST_LOG_TABLE);
+      await this.flushChangedTables();
       return this.errorToResponse(error);
     } finally {
       this.currentRequestBookmark = void 0;
@@ -4394,10 +4449,32 @@ class ShardDO {
    * the panel renders it alongside `ctx.log` lines. Admin-gated by
    * `handleAdminRpc`'s caller (the same `LUNORA_ADMIN_TOKEN` bearer as every
    * other admin write).
-   */
-  handleRecordContainerEvent(args) {
+   *
+   * An `error`-level lifecycle event (a crash/`onError`, or a non-zero-exit
+   * `stop`) is ALSO appended as an `error`-outcome row to the durable
+   * `__lunora_reqlog__` — the same readout `getIssues` groups over — so a
+   * crash-looping container folds into the Issues list right beside Worker
+   * errors (they share the `fingerprintError` hash over `functionPath ::
+   * bucket(message)`). The in-memory buffer stays the live Logs feed; the
+   * durable row is what survives hibernation for triage.
+   */
+  async handleRecordContainerEvent(args) {
     const entry = parseRecordContainerEventArgs(args);
     this.logs.push(entry);
+    const crashed = entry.level === "error" || entry.exitCode !== void 0 && entry.exitCode !== 0;
+    if (crashed) {
+      const logEntry = {
+        durationMs: 0,
+        errorMessage: entry.message,
+        functionPath: entry.functionPath,
+        outcome: "error",
+        shardKey: this.state.id?.name,
+        ts: entry.timestamp
+      };
+      this.persistRequestLog(logEntry, this.requestLogConfig());
+      this.recordChangedTable(REQUEST_LOG_TABLE);
+      await this.flushChangedTables();
+    }
     return jsonResponse({ result: { recorded: true } }, 200);
   }
   /**
@@ -4738,12 +4815,33 @@ class ShardDO {
       ts: Date.now(),
       userId: this.getCurrentUserId()
     };
+    this.persistRequestLog(entry, config);
+  }
+  /**
+   * The single durable-row + Logpush write seam for `__lunora_reqlog__`. Both
+   * the per-dispatch {@link recordRequestLog} and the container-crash path
+   * ({@link handleRecordContainerEvent}) funnel through here so they can't
+   * drift — before this was extracted the container writer persisted the row
+   * but silently skipped the Logpush emit every other error got.
+   *
+   * Best-effort by contract: a SQL failure (e.g. a test double with no `sql`
+   * handle) or a serialization hiccup in the emit must NEVER turn a served
+   * request — or a container event push — into a failed one, so each half is
+   * swallowed independently.
+   *
+   * Errors are always streamed to `console` (rare, high-value — they ride CF
+   * Workers Logs at error level and the dev-server formats them in the
+   * terminal), redacted in prod like any other event. The full per-dispatch
+   * summary stream (successful OKs too) stays opt-in behind
+   * `LUNORA_REQUEST_LOG_EMIT` so a hot shard doesn't emit a line per call.
+   */
+  persistRequestLog(entry, config) {
     const writeOptions = { captureRaw: config.captureRaw, retention: config.retention };
     try {
       appendRequestLogEntry(this.state.storage.sql, entry, writeOptions);
     } catch {
     }
-    if (config.emit || outcome === "error") {
+    if (config.emit || entry.outcome === "error") {
       try {
         emitRequestLogEvent(entry, writeOptions);
       } catch {
@@ -4836,6 +4934,9 @@ class ShardDO {
     if (functionPath === ADMIN_FUNCTIONS.getRequestLog) {
       return this.readAdminRequestLog(sql, args);
     }
+    if (functionPath === ADMIN_FUNCTIONS.getIssues) {
+      return this.readAdminIssues(sql, args);
+    }
     const durable = this.readAdminDurableSignal(functionPath, sql, args);
     if (durable) {
       return durable;
@@ -5066,6 +5167,30 @@ class ShardDO {
     };
     return { result, tables: /* @__PURE__ */ new Set([ADMIN_WILDCARD]) };
   }
+  /**
+   * Resolve a `getIssues` admin read: fold the recent `error`-outcome
+   * request-log rows into grouped {@link readErrorIssues Issues} by fingerprint,
+   * accepting the same optional correlation filters as `getRequestLog`
+   * (function-path prefix, exact shardKey/userId) plus a `limit` on rows
+   * scanned. This is a read over the bounded reqlog readout — no new store —
+   * so a self-hosted worker gets grouped error triage for free. Carries the
+   * {@link ADMIN_WILDCARD} like the other log reads so a live Issues
+   * subscription re-runs on every write-flush (the per-socket JSON memo still
+   * suppresses byte-identical pushes).
+   */
+  // eslint-disable-next-line class-methods-use-this -- kept an instance method for symmetry with the other `readAdmin*` resolvers
+  readAdminIssues(sql, args) {
+    ensureRequestLogTable(sql);
+    const result = {
+      issues: readErrorIssues(sql, {
+        functionPathPrefix: typeof args["functionPathPrefix"] === "string" ? args["functionPathPrefix"] : void 0,
+        limit: typeof args["limit"] === "number" ? args["limit"] : void 0,
+        shardKey: typeof args["shardKey"] === "string" ? args["shardKey"] : void 0,
+        userId: typeof args["userId"] === "string" ? args["userId"] : void 0
+      })
+    };
+    return { result, tables: /* @__PURE__ */ new Set([ADMIN_WILDCARD]) };
+  }
   /**
    * Resolve a `getAuthMetrics` admin read: the durable app-level auth
    * attempt/failure counters + minute-bucketed history the studio SLO panel

package/dist/packem_shared/{serveRelationFanout-C56hKu1O.mjs → serveRelationFanout-BgaNg3Hu.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-Bxdijn66.mjs';
+import { RELATION_FUNCTION_PREFIX } from './ADMIN_FUNCTIONS-CAHLZMj8.mjs';
 
 const serveRelationFanout = async (schema, database, functionPath, args) => {
   const table = typeof args["table"] === "string" ? args["table"] : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.29",
+  "version": "1.0.0-alpha.30",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",
@@ -47,6 +47,7 @@
   },
   "dependencies": {
     "@lunora/errors": "1.0.0-alpha.4",
+    "@lunora/fingerprint": "1.0.0-alpha.1",
     "@visulima/redact": "3.0.0",
     "drizzle-orm": "^0.45.2"
   },