@lunora/do 1.0.0-alpha.30 → 1.0.0-alpha.31

package/dist/index.d.mts

@@ -614,6 +614,13 @@ declare const rankTableName: (table: string, indexName: string) => string;
 * - `rowId` === `doc._id`, the `__id__` tiebreak.
 */
 declare const stableStringify: (value: unknown) => string;
+/**
+* Stable cache/dedup key for a (possibly wire-typed) `value`: the sorted-key
+* stable encoding of its wire form. Byte-identical to `stableStringify(value)`
+* for pure-JSON values; deterministic tagged tokens for `bigint`/`Date`/`Map`/
+* `Set`/`URL`/bytes; throws a `TypeError` on values the wire refuses.
+*/
+declare const stableWireKey: (value: unknown) => string;
 /** A single memoized result, the deps it read, and any active subscribers. */
 interface CacheEntry {
   /** Approximate serialized size of `result`, charged against `maxBytes`. */
@@ -6431,7 +6438,12 @@ declare abstract class ShardDO {
   * server logs, browser history, and `Referer` headers on any
   * subresource the upgrade page loads after the handshake. Use a
   * short-lived rotating token in production rather than a long-lived
-  * secret.
+  * secret — for the ADMIN credential specifically, the worker mints one
+  * (`POST /_lunora/admin/ws-token`) and {@link isAdminSocket} accepts it, so
+  * the master `LUNORA_ADMIN_TOKEN` never rides the URL.
+  *
+  * Async because the admin fallback ({@link isAdminSocket}) verifies the
+  * ephemeral sub-token with WebCrypto HMAC.
   */
   private isUpgradeAllowed;
   /**
@@ -6442,10 +6454,20 @@ declare abstract class ShardDO {
   */
   private suppliedWsToken;
   /**
-  * Whether the upgrade presented a token matching `LUNORA_ADMIN_TOKEN`,
-  * constant-time compared. Closed (returns `false`) when the admin token is
-  * unset, mirroring `isAdminAuthorized` for the HTTP path so admin
-  * streaming is opt-in rather than exposed by default.
+  * Whether the upgrade presented an admin credential: the master
+  * `LUNORA_ADMIN_TOKEN` (constant-time compared) or a short-lived sub-token
+  * the worker minted with it (`POST /_lunora/admin/ws-token` —
+  * HMAC-verified statelessly here, since both isolates hold the master token
+  * in `env`). The ephemeral token is what the studio sends in `?token=`, so
+  * the master credential stays out of URLs/logs. Closed (resolves `false`)
+  * when the admin token is unset, mirroring `isAdminAuthorized` for the HTTP
+  * path so admin streaming is opt-in rather than exposed by default.
+  *
+  * Enforcement: with `LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN` set
+  * (`1`/`true`/`on`/`yes`/`enabled`), a raw master token in the
+  * `?token=` query parameter is rejected — the query string is exactly
+  * where it leaks. The `Authorization` header path still takes the master
+  * token: browsers can't set it on a WS upgrade, so it never rides a URL.
   */
   private isAdminSocket;
   /**
@@ -6682,4 +6704,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stableWireKey, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.d.ts

@@ -614,6 +614,13 @@ declare const rankTableName: (table: string, indexName: string) => string;
 * - `rowId` === `doc._id`, the `__id__` tiebreak.
 */
 declare const stableStringify: (value: unknown) => string;
+/**
+* Stable cache/dedup key for a (possibly wire-typed) `value`: the sorted-key
+* stable encoding of its wire form. Byte-identical to `stableStringify(value)`
+* for pure-JSON values; deterministic tagged tokens for `bigint`/`Date`/`Map`/
+* `Set`/`URL`/bytes; throws a `TypeError` on values the wire refuses.
+*/
+declare const stableWireKey: (value: unknown) => string;
 /** A single memoized result, the deps it read, and any active subscribers. */
 interface CacheEntry {
   /** Approximate serialized size of `result`, charged against `maxBytes`. */
@@ -6431,7 +6438,12 @@ declare abstract class ShardDO {
   * server logs, browser history, and `Referer` headers on any
   * subresource the upgrade page loads after the handshake. Use a
   * short-lived rotating token in production rather than a long-lived
-  * secret.
+  * secret — for the ADMIN credential specifically, the worker mints one
+  * (`POST /_lunora/admin/ws-token`) and {@link isAdminSocket} accepts it, so
+  * the master `LUNORA_ADMIN_TOKEN` never rides the URL.
+  *
+  * Async because the admin fallback ({@link isAdminSocket}) verifies the
+  * ephemeral sub-token with WebCrypto HMAC.
   */
   private isUpgradeAllowed;
   /**
@@ -6442,10 +6454,20 @@ declare abstract class ShardDO {
   */
   private suppliedWsToken;
   /**
-  * Whether the upgrade presented a token matching `LUNORA_ADMIN_TOKEN`,
-  * constant-time compared. Closed (returns `false`) when the admin token is
-  * unset, mirroring `isAdminAuthorized` for the HTTP path so admin
-  * streaming is opt-in rather than exposed by default.
+  * Whether the upgrade presented an admin credential: the master
+  * `LUNORA_ADMIN_TOKEN` (constant-time compared) or a short-lived sub-token
+  * the worker minted with it (`POST /_lunora/admin/ws-token` —
+  * HMAC-verified statelessly here, since both isolates hold the master token
+  * in `env`). The ephemeral token is what the studio sends in `?token=`, so
+  * the master credential stays out of URLs/logs. Closed (resolves `false`)
+  * when the admin token is unset, mirroring `isAdminAuthorized` for the HTTP
+  * path so admin streaming is opt-in rather than exposed by default.
+  *
+  * Enforcement: with `LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN` set
+  * (`1`/`true`/`on`/`yes`/`enabled`), a raw master token in the
+  * `?token=` query parameter is rejected — the query string is exactly
+  * where it leaks. The `Authorization` header path still takes the master
+  * token: browsers can't set it on a WS upgrade, so it never rides a URL.
   */
   private isAdminSocket;
   /**
@@ -6682,4 +6704,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stableWireKey, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.mjs

@@ -7,9 +7,9 @@ export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStruc
 export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
-export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-CTqZisSC.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-CYkt7Ru8.mjs';
+export { diffExternalSource } from './packem_shared/diffExternalSource-CovHfdyo.mjs';
+export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-CoGmFmsY.mjs';
+export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-Bj7I3v1b.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
 export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-CAHLZMj8.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
@@ -18,7 +18,7 @@ export { default as NotFoundError } from './packem_shared/NotFoundError-C70b9hLw
 export { armRestore, readBookmark } from './packem_shared/armRestore-4Px61hHS.mjs';
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-WQY8m62C.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
-export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
+export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-DnSvbjil.mjs';
 export { serveRelationFanout } from './packem_shared/serveRelationFanout-BgaNg3Hu.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BXSq3S70.mjs';
@@ -26,9 +26,9 @@ export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_share
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BA8QOChj.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BWz51mpB.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
-export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-D57CJaT9.mjs';
+export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-iFAA8FbD.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';
 export { ConflictError } from './packem_shared/ConflictError-CLoq37xH.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
@@ -36,5 +36,6 @@ export { compileWhereSql } from './packem_shared/compileWhereSql-DE6yfRcQ.mjs';
 export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DjJEHiM2.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-DDoT-UUI.mjs';
 export { runShardMigrations } from './packem_shared/runShardMigrations-BGx4v2B6.mjs';
-export { stableStringify } from './packem_shared/stableStringify-MydiuScU.mjs';
-export { s as subscriptionListDeltas } from './packem_shared/subscription-delivery-CWigSEr3.mjs';
+export { stableStringify } from './packem_shared/stableStringify-mC40mZts.mjs';
+export { stableWireKey } from './packem_shared/stableWireKey-DKuXO7T5.mjs';
+export { subscriptionListDeltas } from './packem_shared/subscriptionListDeltas-CT76bYny.mjs';

package/dist/packem_shared/{MAX_SQL_ROWS-D57CJaT9.mjs → MAX_SQL_ROWS-iFAA8FbD.mjs}

@@ -3,9 +3,39 @@ import { LunoraError } from '@lunora/errors';
 const MAX_SQL_ROWS = 1e3;
 const READONLY_LEAD = /^(?:explain\s+(?:query\s+plan\s+)?)?(?:select|with)\b/iu;
 const FORBIDDEN_KEYWORD = /\b(?:alter|attach|create|delete|detach|drop|insert|pragma|reindex|replace|truncate|update|vacuum)\b/iu;
-const LEADING_NOISE = /^(?:\s|--[^\n]*\n?|\/\*[\s\S]*?\*\/)+/u;
 const TRAILING_SEMICOLON = /;\s*$/u;
-const stripLeading = (sql) => sql.replace(LEADING_NOISE, "");
+const WHITESPACE = /\s/u;
+const skipLineComment = (sql, from) => {
+  let index = from + 2;
+  while (index < sql.length && sql[index] !== "\n") {
+    index += 1;
+  }
+  return index;
+};
+const skipBlockComment = (sql, from) => {
+  const close = sql.indexOf("*/", from + 2);
+  return close === -1 ? -1 : close + 2;
+};
+const stripLeading = (sql) => {
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql[index];
+    if (char !== void 0 && WHITESPACE.test(char)) {
+      index += 1;
+    } else if (char === "-" && sql[index + 1] === "-") {
+      index = skipLineComment(sql, index);
+    } else if (char === "/" && sql[index + 1] === "*") {
+      const next = skipBlockComment(sql, index);
+      if (next === -1) {
+        break;
+      }
+      index = next;
+    } else {
+      break;
+    }
+  }
+  return sql.slice(index);
+};
 const sqlError = (message, code) => new LunoraError(code, message, { status: 400 });
 const assertReadonly = (query) => {
   const trimmed = stripLeading(query).trim();

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-BA8QOChj.mjs → ROOT_DO_SIZE_WARN_BYTES-BWz51mpB.mjs}

@@ -2,7 +2,7 @@ import { LunoraError, toErrorBody } from '@lunora/errors';
 import { drizzle } from 'drizzle-orm/durable-sqlite';
 import { c as constantTimeEqual } from './constant-time-equal-BVRWZgES.mjs';
 import { j as jsonResponse } from './json-response-BdbtpOhm.mjs';
-import { e as encodeWire, a as awaitWsDrain, t as trySendFrame, d as decodeWire, s as subscriptionListDeltas, b as sendDeltaFrames } from './subscription-delivery-CWigSEr3.mjs';
+import { e as encodeWire, d as decodeWire } from './wire-codec-CzQc1pvf.mjs';
 import { parseExportShardArgs, parseImportShardArgs } from './exportShardRows-Dy3oFZ26.mjs';
 import { recordAuthEvent, readAuthMetrics } from './AUTH_METRICS_BUCKETS_TABLE-CiHHYeJi.mjs';
 import { DATA_MIGRATION_STATE_TABLE, readMigrationStatus } from './DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
@@ -12,19 +12,84 @@ import { createFanoutCounters, ADMIN_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX,
 import { LogBuffer } from './LogBuffer-B_Ezju_N.mjs';
 import { recordCapturedMail, clearCapturedMail, readCapturedMail, MAIL_TABLE } from './MAIL_RETENTION-CPpgl-dX.mjs';
 import { readBookmark, armRestore } from './armRestore-4Px61hHS.mjs';
-import { ReactiveCache, reactiveCacheKey } from './ReactiveCache-BYlSGY0N.mjs';
-import { stableStringify } from './stableStringify-MydiuScU.mjs';
+import { ReactiveCache, reactiveCacheKey } from './ReactiveCache-DnSvbjil.mjs';
+import { stableWireKey } from './stableWireKey-DKuXO7T5.mjs';
+import { awaitWsDrain, trySendFrame, subscriptionListDeltas, sendDeltaFrames } from './subscriptionListDeltas-CT76bYny.mjs';
 import { fingerprintError } from '@lunora/fingerprint';
 import { redact, standardRules } from '@visulima/redact';
 import { i as isDevEnvironment, c as buildSettings, b as buildSecurityAudit } from './security-audit-CucgBice.mjs';
-import { runReadonlySql } from './MAX_SQL_ROWS-D57CJaT9.mjs';
+import { runReadonlySql } from './MAX_SQL_ROWS-iFAA8FbD.mjs';
 import { ConflictError } from './ConflictError-CLoq37xH.mjs';
 import { e as deleteGlobalShapeSnapshotsForConnection, g as readIdempotent, h as writeIdempotent, t as trimIdempotent, r as readClientWatermark, m as migrateClientWatermark, c as advanceClientWatermark, d as deleteGlobalShapeSnapshot, f as readGlobalShapeSnapshot, w as writeGlobalShapeSnapshot } from './ctx-db-idempotency-BdcNpvY4.mjs';
 import { CDC_LOG_TABLE, readCdcChanges, readCdcCursor, readCdcEpoch, minCdcSeq, bumpCdcEpoch } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
+import { stableStringify } from './stableStringify-mC40mZts.mjs';
 import { a as selectShapeMemberIds, s as selectShapeRows } from './ctx-db-shapes-Cz9dHyh1.mjs';
 
 const MAX_BATCH_ENTRIES = 500;
 
+const evictOldestEntry = (map, capacity) => {
+  if (map.size < capacity) {
+    return;
+  }
+  const oldest = map.keys().next().value;
+  if (oldest !== void 0) {
+    map.delete(oldest);
+  }
+};
+
+const textEncoder = new TextEncoder();
+const fromBase64Url = (input) => {
+  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.codePointAt(index) ?? 0;
+  }
+  return bytes;
+};
+const KEY_CACHE_MAX = 64;
+const keyCache = /* @__PURE__ */ new Map();
+const importHmacKey = async (secret) => {
+  const cached = keyCache.get(secret);
+  if (cached) {
+    return cached;
+  }
+  evictOldestEntry(keyCache, KEY_CACHE_MAX);
+  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
+  keyCache.set(secret, keyPromise);
+  return keyPromise;
+};
+const verifyCanonical = async (secret, canonical, sigBytes) => {
+  const cryptoKey = await importHmacKey(secret);
+  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
+};
+
+const WS_ADMIN_TOKEN_VERSION = "v1";
+const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
+  if (secret.length === 0 || token.length === 0) {
+    return false;
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [version, expString, signature] = parts;
+  if (version !== WS_ADMIN_TOKEN_VERSION || signature.length === 0) {
+    return false;
+  }
+  const expiresAtMs = Number(expString);
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now) {
+    return false;
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = fromBase64Url(signature);
+  } catch {
+    return false;
+  }
+  return verifyCanonical(secret, `${version}.${expString}`, signatureBytes);
+};
+
 const AUDIT_LOG_TABLE = "__lunora_audit__";
 const AUDIT_LOG_RETENTION = 1e3;
 const runSql$3 = (sql, query, ...params) => {
@@ -321,7 +386,7 @@ const parseRelayName = (name) => {
   return { ownerKey, relayIndex };
 };
 
-const shapeRoutingKey = (name, args) => stableStringify({ args: args ?? {}, name });
+const shapeRoutingKey = (name, args) => stableWireKey({ args: args ?? {}, name });
 const DEFAULT_PROMOTION_THRESHOLDS = { tDown: 4e3, tUp: 8e3 };
 const nextPromotionState = (current, subscribers, thresholds = DEFAULT_PROMOTION_THRESHOLDS) => {
   if (thresholds.tDown >= thresholds.tUp) {
@@ -480,12 +545,12 @@ class RelayLink {
       case "relay_shape_poke": {
         const iterated = this.host.getWebSockets().length;
         const startMs = Date.now();
-        const delivered = this.onShapePoke(message);
+        const delivered = this.onShapePoke({ ...message, args: decodeWire(message.args) });
         this.host.recordShapePokeFanout(iterated, delivered, Date.now() - startMs);
         return noContent();
       }
       case "relay_shape_subscribe": {
-        return jsonRelayResponse(this.onShapeSubscribe(message));
+        return jsonRelayResponse(this.onShapeSubscribe({ ...message, args: decodeWire(message.args) }));
       }
       default: {
         return assertNeverFrame(message);
@@ -677,7 +742,9 @@ class OwnerRelay extends RelayLink {
       }
       entry.cursor = frameCursor;
       const poke = {
-        args: entry.args,
+        // `args` wire-encoded for the same reason as `rowsPatch` below; the
+        // relay decodes them at `handleControl` before the routing match.
+        args: encodeWire(entry.args),
         checkpoint: frameCursor,
         epoch,
         fromCursor,
@@ -724,7 +791,9 @@ class OwnerRelay extends RelayLink {
       }
       entry.cursor = frameCursor;
       const poke = {
-        args: entry.args,
+        // `args` wire-encoded like `rowsPatch`; decoded relay-side at
+        // `handleControl` before the routing match.
+        args: encodeWire(entry.args),
         checkpoint: frameCursor,
         epoch,
         fromCursor,
@@ -859,8 +928,8 @@ class OwnerRelay extends RelayLink {
     if (this.tableHasAnyMask(base.table)) {
       return false;
     }
-    const baseWhere = stableStringify(base.effectiveWhere);
-    const baseColumns = stableStringify(base.columns);
+    const baseWhere = stableWireKey(base.effectiveWhere);
+    const baseColumns = stableWireKey(base.columns);
     let enumerated = false;
     const populate = (side) => {
       const backing = { groups: [`grp_${side}`], roles: [side], sub: `__lunora_probe_${side}__` };
@@ -890,7 +959,7 @@ class OwnerRelay extends RelayLink {
       } catch {
         return false;
       }
-      return resolved !== void 0 && resolved.global !== true && resolved.table === base.table && stableStringify(resolved.effectiveWhere) === baseWhere && stableStringify(resolved.columns) === baseColumns;
+      return resolved !== void 0 && resolved.global !== true && resolved.table === base.table && stableWireKey(resolved.effectiveWhere) === baseWhere && stableWireKey(resolved.columns) === baseColumns;
     });
     return matches && !enumerated;
   }
@@ -938,7 +1007,10 @@ class RelayMember extends RelayLink {
     }
     await this.announce();
     const request = {
-      args: shape.args ?? {},
+      // Wire-encode before the relay->owner `JSON.stringify` hop: the shard
+      // decoded these args at its `shape_subscribe` entry point, so a
+      // `bigint`/`Date`/bytes arg would otherwise throw (or corrupt) here.
+      args: encodeWire(shape.args ?? {}),
       connectionId: this.host.readAttachment(ws).connectionId,
       identity: identity.identity,
       name: shape.name,
@@ -1420,6 +1492,7 @@ const findDanglingReferences = (sql, storageColumns, liveKeys) => {
 
 const WS_KEEPALIVE_PING = "lunora-ping";
 const WS_KEEPALIVE_PONG = "lunora-pong";
+const REQUIRE_EPHEMERAL_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
 const UNDELIVERED_BASELINE = "<undelivered>";
 const ROOT_DO_SIZE_WARN_BYTES = 1073741824;
 const CDC_RESUME_SCAN_LIMIT = 1e4;
@@ -2512,7 +2585,24 @@ class ShardDO {
         ws.send(JSON.stringify({ id: envelope.id, message: "admin subscription requires admin authorization", type: "error" }));
         return;
       }
-      const status = this.subscribe(ws, envelope.id, envelope.query);
+      let query;
+      try {
+        query = envelope.query.args === void 0 ? envelope.query : { ...envelope.query, args: decodeWire(envelope.query.args) };
+      } catch {
+        try {
+          ws.send(
+            JSON.stringify({
+              code: "BAD_SUBSCRIPTION_ARGS",
+              error: { code: "BAD_SUBSCRIPTION_ARGS", message: "subscription args failed wire decoding" },
+              id: envelope.id,
+              type: "error"
+            })
+          );
+        } catch {
+        }
+        return;
+      }
+      const status = this.subscribe(ws, envelope.id, query);
       if (status !== "ok") {
         const code = status === "too_many" ? "TOO_MANY_SUBSCRIPTIONS" : "SUBSCRIPTION_PERSIST_FAILED";
         const errorMessage = status === "too_many" ? `subscription cap of ${String(ShardDO.MAX_SUBSCRIPTIONS_PER_SOCKET)} reached on this socket` : "failed to persist subscription attachment";
@@ -2524,13 +2614,20 @@ class ShardDO {
       }
       ws.send(JSON.stringify({ id: envelope.id, type: "ack" }));
       if (functionPath) {
-        await this.seedSubscription(ws, envelope.id, envelope.query, functionPath, isAdmin);
+        await this.seedSubscription(ws, envelope.id, query, functionPath, isAdmin);
       }
       return;
     }
     if (envelope.type === "shape_subscribe" && envelope.shape) {
+      let shapeArgs;
+      try {
+        shapeArgs = envelope.shape.args === void 0 ? void 0 : decodeWire(envelope.shape.args);
+      } catch {
+        this.sendShapeSubscribeError(ws, envelope.id, "BAD_SUBSCRIPTION_ARGS", "shape args failed wire decoding");
+        return;
+      }
       await this.handleShapeSubscribe(ws, envelope.id, {
-        args: envelope.shape.args,
+        args: shapeArgs,
         name: envelope.shape.name,
         sinceEpoch: envelope.sinceEpoch,
         sinceSeq: envelope.sinceCheckpoint
@@ -6303,9 +6400,14 @@ class ShardDO {
    * server logs, browser history, and `Referer` headers on any
    * subresource the upgrade page loads after the handshake. Use a
    * short-lived rotating token in production rather than a long-lived
-   * secret.
+   * secret — for the ADMIN credential specifically, the worker mints one
+   * (`POST /_lunora/admin/ws-token`) and {@link isAdminSocket} accepts it, so
+   * the master `LUNORA_ADMIN_TOKEN` never rides the URL.
+   *
+   * Async because the admin fallback ({@link isAdminSocket}) verifies the
+   * ephemeral sub-token with WebCrypto HMAC.
    */
-  isUpgradeAllowed(request) {
+  async isUpgradeAllowed(request) {
     const env = this.env ?? {};
     const allowedOrigins = env.LUNORA_ALLOWED_ORIGINS;
     if (allowedOrigins && allowedOrigins.trim() !== "") {
@@ -6321,7 +6423,7 @@ class ShardDO {
     const expectedBearer = env.LUNORA_WS_BEARER;
     if (expectedBearer && expectedBearer.length > 0) {
       const supplied = this.suppliedWsToken(request);
-      if (!supplied || !constantTimeEqual(supplied, expectedBearer) && !this.isAdminSocket(request)) {
+      if (!supplied || !constantTimeEqual(supplied, expectedBearer) && !await this.isAdminSocket(request)) {
         return false;
       }
     }
@@ -6342,19 +6444,40 @@ class ShardDO {
     return new URL(request.url).searchParams.get("token") ?? void 0;
   }
   /**
-   * Whether the upgrade presented a token matching `LUNORA_ADMIN_TOKEN`,
-   * constant-time compared. Closed (returns `false`) when the admin token is
-   * unset, mirroring `isAdminAuthorized` for the HTTP path so admin
-   * streaming is opt-in rather than exposed by default.
+   * Whether the upgrade presented an admin credential: the master
+   * `LUNORA_ADMIN_TOKEN` (constant-time compared) or a short-lived sub-token
+   * the worker minted with it (`POST /_lunora/admin/ws-token` —
+   * HMAC-verified statelessly here, since both isolates hold the master token
+   * in `env`). The ephemeral token is what the studio sends in `?token=`, so
+   * the master credential stays out of URLs/logs. Closed (resolves `false`)
+   * when the admin token is unset, mirroring `isAdminAuthorized` for the HTTP
+   * path so admin streaming is opt-in rather than exposed by default.
+   *
+   * Enforcement: with `LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN` set
+   * (`1`/`true`/`on`/`yes`/`enabled`), a raw master token in the
+   * `?token=` query parameter is rejected — the query string is exactly
+   * where it leaks. The `Authorization` header path still takes the master
+   * token: browsers can't set it on a WS upgrade, so it never rides a URL.
    */
-  isAdminSocket(request) {
+  async isAdminSocket(request) {
     const env = this.env ?? {};
     const adminToken = env.LUNORA_ADMIN_TOKEN;
     if (!adminToken || adminToken.length === 0) {
       return false;
     }
     const supplied = this.suppliedWsToken(request);
-    return supplied !== void 0 && constantTimeEqual(supplied, adminToken);
+    if (supplied === void 0) {
+      return false;
+    }
+    if (await verifyWsAdminToken(adminToken, supplied)) {
+      return true;
+    }
+    const fromQuery = extractBearerToken(request.headers.get("authorization")) === void 0;
+    const requireEphemeral = REQUIRE_EPHEMERAL_ENV_VALUES.has((env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN ?? "").trim().toLowerCase());
+    if (fromQuery && requireEphemeral) {
+      return false;
+    }
+    return constantTimeEqual(supplied, adminToken);
   }
   /**
    * Register the hibernation-safe ping/pong keepalive. The runtime answers a
@@ -6396,10 +6519,11 @@ class ShardDO {
     }
     return void 0;
   }
-  handleWebSocketUpgrade(request) {
-    if (!this.isUpgradeAllowed(request)) {
+  async handleWebSocketUpgrade(request) {
+    if (!await this.isUpgradeAllowed(request)) {
       return new Response("Forbidden", { status: 403 });
     }
+    const admin = await this.isAdminSocket(request);
     const pair = new WebSocketPair();
     const client = pair[0];
     const server = pair[1];
@@ -6409,7 +6533,7 @@ class ShardDO {
     const expiresAtRaw = Number(request.headers.get("x-lunora-identity-exp"));
     const expiresAt = Number.isFinite(expiresAtRaw) && expiresAtRaw > 0 ? expiresAtRaw : void 0;
     server.serializeAttachment?.({
-      admin: this.isAdminSocket(request),
+      admin,
       connectionId: crypto.randomUUID(),
       subs: {},
       ...expiresAt === void 0 ? {} : { expiresAt },

package/dist/packem_shared/{ReactiveCache-BYlSGY0N.mjs → ReactiveCache-DnSvbjil.mjs}

@@ -1,5 +1,6 @@
-import { stableStringify } from './stableStringify-MydiuScU.mjs';
+import { stableWireKey } from './stableWireKey-DKuXO7T5.mjs';
 import { depKey, SCAN_DEP } from './SCAN_DEP-DLJF8dsj.mjs';
+export { stableStringify } from './stableStringify-mC40mZts.mjs';
 
 const DEFAULT_MAX_ENTRIES = 1e3;
 const DEFAULT_MAX_BYTES = 4 * 1024 * 1024;
@@ -227,6 +228,6 @@ class ReactiveCache {
     }
   }
 }
-const reactiveCacheKey = (functionPath, args, identity) => `${identity ?? "\0anon"}\0${functionPath}:${stableStringify(args)}`;
+const reactiveCacheKey = (functionPath, args, identity) => `${identity ?? "\0anon"}\0${functionPath}:${stableWireKey(args)}`;
 
-export { ReactiveCache, reactiveCacheKey, stableStringify };
+export { ReactiveCache, reactiveCacheKey, stableWireKey };

package/dist/packem_shared/{diffExternalSource-Cx9HUPJj.mjs → diffExternalSource-CovHfdyo.mjs}

@@ -1,4 +1,4 @@
-import { stableStringify } from './stableStringify-MydiuScU.mjs';
+import { stableStringify } from './stableStringify-mC40mZts.mjs';
 
 const projectExternalSourceRow = (row, columns) => {
   const projected = { _id: row._id };

package/dist/packem_shared/{isSourceDue-CYkt7Ru8.mjs → isSourceDue-Bj7I3v1b.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError } from '@lunora/errors';
-import { runExternalSourceTick } from './materializeExternalRows-CTqZisSC.mjs';
+import { runExternalSourceTick } from './materializeExternalRows-CoGmFmsY.mjs';
 
 const liftSourceId = (row, options = {}) => {
   const { idColumn = "id", map } = options;

package/dist/packem_shared/{materializeExternalRows-CTqZisSC.mjs → materializeExternalRows-CoGmFmsY.mjs}

@@ -1,7 +1,7 @@
 import { applyCdcChanges } from './CDC_LOG_TABLE-DjJEHiM2.mjs';
 import { s as selectShapeRows } from './ctx-db-shapes-Cz9dHyh1.mjs';
-import { diffExternalSource, projectExternalSourceRow } from './diffExternalSource-Cx9HUPJj.mjs';
-import { stableStringify } from './stableStringify-MydiuScU.mjs';
+import { diffExternalSource, projectExternalSourceRow } from './diffExternalSource-CovHfdyo.mjs';
+import { stableStringify } from './stableStringify-mC40mZts.mjs';
 
 const materializeExternalRows = async (writer, pulled, baseline, options) => {
   const { changes, nextBaseline } = diffExternalSource(pulled, baseline, options);

package/dist/packem_shared/{stableStringify-MydiuScU.mjs → stableStringify-mC40mZts.mjs}

@@ -9,7 +9,7 @@ const stableStringify = (value) => {
     return "null";
   }
   if (typeof value === "bigint") {
-    throw new TypeError("stableStringify: cannot use a bigint in a cache key (query/subscription/shape args) — pass it as a string");
+    throw new TypeError("stableStringify: cannot use a bigint in a stable JSON cache key — pass it as a string, or use stableWireKey");
   }
   if (value === null || typeof value !== "object") {
     return JSON.stringify(value);
@@ -21,7 +21,7 @@ const stableStringify = (value) => {
   if (proto !== null && proto !== Object.prototype) {
     const name = value.constructor?.name ?? "value";
     throw new TypeError(
-      `stableStringify: cannot use a ${name} in a cache key (query/subscription/shape args) — only plain objects, arrays, and JSON primitives are supported`
+      `stableStringify: cannot use a ${name} in a stable JSON cache key — only plain objects, arrays, and JSON primitives are supported (wire-typed values key via stableWireKey)`
     );
   }
   const record = value;

package/dist/packem_shared/stableWireKey-DKuXO7T5.mjs

@@ -0,0 +1,6 @@
+import { stableStringify } from './stableStringify-mC40mZts.mjs';
+import { e as encodeWire } from './wire-codec-CzQc1pvf.mjs';
+
+const stableWireKey = (value) => stableStringify(encodeWire(value));
+
+export { stableWireKey };

package/dist/packem_shared/subscriptionListDeltas-CT76bYny.mjs

@@ -0,0 +1,126 @@
+import { e as encodeWire } from './wire-codec-CzQc1pvf.mjs';
+
+const ROW_ID_FIELD = "_id";
+const DELTA_FALLBACK_TABLE = "__lunora__";
+const readRowId = (row) => {
+  if (typeof row !== "object" || row === null || Array.isArray(row)) {
+    return void 0;
+  }
+  const id = row[ROW_ID_FIELD];
+  return typeof id === "string" ? id : void 0;
+};
+const indexRowsById = (rows) => {
+  const byId = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const row of rows) {
+    const id = readRowId(row);
+    if (id === void 0 || byId.has(id)) {
+      return void 0;
+    }
+    byId.set(id, row);
+    order.push(id);
+  }
+  return { byId, order };
+};
+const survivorsKeepOrder = (previous, next) => {
+  const survivingPrevious = previous.order.filter((id) => next.byId.has(id));
+  const survivingNext = next.order.filter((id) => previous.byId.has(id));
+  if (survivingPrevious.length !== survivingNext.length) {
+    return false;
+  }
+  return survivingPrevious.every((id, index) => survivingNext[index] === id);
+};
+const collectDeleteDeltas = (previous, next, deltaTable, tableJson) => {
+  const out = [];
+  for (const id of previous.order) {
+    if (!next.byId.has(id)) {
+      out.push({
+        delta: { key: id, op: "delete", table: deltaTable },
+        frame: `{"key":${JSON.stringify(id)},"op":"delete","table":${tableJson}}`
+      });
+    }
+  }
+  return out;
+};
+const collectUpsertDeltas = (previous, next, deltaTable, tableJson) => {
+  const out = [];
+  for (const id of next.order) {
+    const nextRow = next.byId.get(id);
+    const previousRow = previous.byId.get(id);
+    const nextFingerprint = JSON.stringify(encodeWire(nextRow));
+    const previousFingerprint = previousRow === void 0 ? void 0 : JSON.stringify(previousRow);
+    if (previousFingerprint === nextFingerprint) {
+      continue;
+    }
+    const op = previousFingerprint === void 0 ? "insert" : "update";
+    out.push({
+      delta: { key: id, op, row: nextRow, table: deltaTable },
+      frame: `{"key":${JSON.stringify(id)},"op":"${op}","row":${nextFingerprint},"table":${tableJson}}`
+    });
+  }
+  return out;
+};
+const subscriptionListDeltas = (previousJson, nextResult, table, frames) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(previousJson);
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(parsed) || !Array.isArray(nextResult)) {
+    return void 0;
+  }
+  const previous = indexRowsById(parsed);
+  const next = indexRowsById(nextResult);
+  if (previous === void 0 || next === void 0) {
+    return void 0;
+  }
+  if (!survivorsKeepOrder(previous, next)) {
+    return void 0;
+  }
+  const deltaTable = table === "" ? DELTA_FALLBACK_TABLE : table;
+  const tableJson = JSON.stringify(deltaTable);
+  const framed = [...collectDeleteDeltas(previous, next, deltaTable, tableJson), ...collectUpsertDeltas(previous, next, deltaTable, tableJson)];
+  if (framed.length > next.order.length) {
+    return void 0;
+  }
+  if (frames !== void 0) {
+    for (const { frame } of framed) {
+      frames.push(frame);
+    }
+  }
+  return framed.map(({ delta }) => delta);
+};
+const trySendFrame = (ws, frame) => {
+  try {
+    ws.send(frame);
+    return true;
+  } catch {
+    return false;
+  }
+};
+const sendDeltaFrames = (ws, subId, deltaFrames, cursorSuffix) => {
+  const idJson = JSON.stringify(subId);
+  let delivered = true;
+  for (const deltaBody of deltaFrames) {
+    if (!trySendFrame(ws, `{"type":"delta","id":${idJson},"delta":${deltaBody}${cursorSuffix}}`)) {
+      delivered = false;
+    }
+  }
+  return delivered;
+};
+const awaitWsDrain = async (ws) => {
+  let attempts = 0;
+  while (attempts < 100) {
+    attempts += 1;
+    const buffered = ws.bufferedAmount;
+    if (typeof buffered !== "number" || buffered < 1048576) {
+      return;
+    }
+    await new Promise((resolve) => {
+      setTimeout(resolve, 20);
+    });
+  }
+};
+
+export { awaitWsDrain, sendDeltaFrames, subscriptionListDeltas, trySendFrame };

package/dist/packem_shared/{subscription-delivery-CWigSEr3.mjs → wire-codec-CzQc1pvf.mjs}

@@ -222,127 +222,4 @@ const decodeWire = (value, depth = 0) => {
   return result;
 };
 
-const ROW_ID_FIELD = "_id";
-const DELTA_FALLBACK_TABLE = "__lunora__";
-const readRowId = (row) => {
-  if (typeof row !== "object" || row === null || Array.isArray(row)) {
-    return void 0;
-  }
-  const id = row[ROW_ID_FIELD];
-  return typeof id === "string" ? id : void 0;
-};
-const indexRowsById = (rows) => {
-  const byId = /* @__PURE__ */ new Map();
-  const order = [];
-  for (const row of rows) {
-    const id = readRowId(row);
-    if (id === void 0 || byId.has(id)) {
-      return void 0;
-    }
-    byId.set(id, row);
-    order.push(id);
-  }
-  return { byId, order };
-};
-const survivorsKeepOrder = (previous, next) => {
-  const survivingPrevious = previous.order.filter((id) => next.byId.has(id));
-  const survivingNext = next.order.filter((id) => previous.byId.has(id));
-  if (survivingPrevious.length !== survivingNext.length) {
-    return false;
-  }
-  return survivingPrevious.every((id, index) => survivingNext[index] === id);
-};
-const collectDeleteDeltas = (previous, next, deltaTable, tableJson) => {
-  const out = [];
-  for (const id of previous.order) {
-    if (!next.byId.has(id)) {
-      out.push({
-        delta: { key: id, op: "delete", table: deltaTable },
-        frame: `{"key":${JSON.stringify(id)},"op":"delete","table":${tableJson}}`
-      });
-    }
-  }
-  return out;
-};
-const collectUpsertDeltas = (previous, next, deltaTable, tableJson) => {
-  const out = [];
-  for (const id of next.order) {
-    const nextRow = next.byId.get(id);
-    const previousRow = previous.byId.get(id);
-    const nextFingerprint = JSON.stringify(encodeWire(nextRow));
-    const previousFingerprint = previousRow === void 0 ? void 0 : JSON.stringify(previousRow);
-    if (previousFingerprint === nextFingerprint) {
-      continue;
-    }
-    const op = previousFingerprint === void 0 ? "insert" : "update";
-    out.push({
-      delta: { key: id, op, row: nextRow, table: deltaTable },
-      frame: `{"key":${JSON.stringify(id)},"op":"${op}","row":${nextFingerprint},"table":${tableJson}}`
-    });
-  }
-  return out;
-};
-const subscriptionListDeltas = (previousJson, nextResult, table, frames) => {
-  let parsed;
-  try {
-    parsed = JSON.parse(previousJson);
-  } catch {
-    return void 0;
-  }
-  if (!Array.isArray(parsed) || !Array.isArray(nextResult)) {
-    return void 0;
-  }
-  const previous = indexRowsById(parsed);
-  const next = indexRowsById(nextResult);
-  if (previous === void 0 || next === void 0) {
-    return void 0;
-  }
-  if (!survivorsKeepOrder(previous, next)) {
-    return void 0;
-  }
-  const deltaTable = table === "" ? DELTA_FALLBACK_TABLE : table;
-  const tableJson = JSON.stringify(deltaTable);
-  const framed = [...collectDeleteDeltas(previous, next, deltaTable, tableJson), ...collectUpsertDeltas(previous, next, deltaTable, tableJson)];
-  if (framed.length > next.order.length) {
-    return void 0;
-  }
-  if (frames !== void 0) {
-    for (const { frame } of framed) {
-      frames.push(frame);
-    }
-  }
-  return framed.map(({ delta }) => delta);
-};
-const trySendFrame = (ws, frame) => {
-  try {
-    ws.send(frame);
-    return true;
-  } catch {
-    return false;
-  }
-};
-const sendDeltaFrames = (ws, subId, deltaFrames, cursorSuffix) => {
-  const idJson = JSON.stringify(subId);
-  let delivered = true;
-  for (const deltaBody of deltaFrames) {
-    if (!trySendFrame(ws, `{"type":"delta","id":${idJson},"delta":${deltaBody}${cursorSuffix}}`)) {
-      delivered = false;
-    }
-  }
-  return delivered;
-};
-const awaitWsDrain = async (ws) => {
-  let attempts = 0;
-  while (attempts < 100) {
-    attempts += 1;
-    const buffered = ws.bufferedAmount;
-    if (typeof buffered !== "number" || buffered < 1048576) {
-      return;
-    }
-    await new Promise((resolve) => {
-      setTimeout(resolve, 20);
-    });
-  }
-};
-
-export { awaitWsDrain as a, sendDeltaFrames as b, decodeWire as d, encodeWire as e, subscriptionListDeltas as s, trySendFrame as t };
+export { decodeWire as d, encodeWire as e };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.30",
+  "version": "1.0.0-alpha.31",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",
@@ -46,8 +46,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.4",
-    "@lunora/fingerprint": "1.0.0-alpha.1",
+    "@lunora/errors": "1.0.0-alpha.5",
+    "@lunora/fingerprint": "1.0.0-alpha.2",
     "@visulima/redact": "3.0.0",
     "drizzle-orm": "^0.45.2"
   },

package/dist/packem_shared/subscriptionListDeltas-DRLvFlM1.mjs

@@ -1 +0,0 @@
-export { a as awaitWsDrain, b as sendDeltaFrames, s as subscriptionListDeltas, t as trySendFrame } from './subscription-delivery-CWigSEr3.mjs';