@lunora/do 1.0.0-alpha.41 → 1.0.0-alpha.43

package/dist/index.d.mts

@@ -2425,8 +2425,11 @@ interface TracerDeps {
    * **custom span**, so it nests inside CF's native binding/fetch/handler trace
    * tree on the hosted path. This only ADDS a CF-side span — the recorded
    * {@link SpanEvent} (our `SpanBuffer`/`otlpSink`) is untouched and remains the
-   * source of truth plus the local studio waterfall. See {@link createTracer}
-   * for the double-export and Durable-Object async-context caveats.
+   * source of truth plus the local studio waterfall. The `enterSpan` call itself
+   * is now workerd-validated as available and side-effect-free inside a Durable
+   * Object; CF's exported parent-linking under sampling remains unverified. See
+   * {@link createTracer} for the double-export and Durable-Object async-context
+   * caveats.
    */
   fuseCloudflareSpans?: boolean;
   /** Hand a finished span to the buffer + sink. */
@@ -2488,12 +2491,22 @@ interface MetricsDeps {
  * pipelines — an intentional, documented trade the operator opts into, not a
  * default.
  *
- * **DO async-context caveat.** `tracing.enterSpan`'s parent-linking inside Durable
- * Objects is unverified upstream, so this is capability-probed: an
- * absent/undefined `tracing`, a missing `enterSpan`, or an off-CF/unsampled run
- * all resolve to `undefined` and the bridge is a total no-op — exact prior
- * behavior. If CF's ambient-span linkage misbehaves in a DO, the worst case is a
- * mis-parented CF span; our own recorded waterfall is unaffected.
+ * **DO async-context caveat (EXPERIMENTAL, partially workerd-validated).**
+ * `tracing.enterSpan` is now confirmed to EXIST and RUN inside a real Durable
+ * Object under `@cloudflare/vitest-pool-workers` (see
+ * `__tests__/workerd/context-telemetry-cf-bridge.workerd.test.ts`): it resolves
+ * from `cloudflare:workers`, its callback executes and returns the body value
+ * without throwing, `span.isTraced` is a real boolean, and — the key additive
+ * guarantee — our recorded {@link SpanEvent} tree (parent/child via the threaded
+ * `parentSpanId`) is byte-for-byte identical with the bridge on vs off. What that
+ * harness CANNOT prove is CF's own *exported* parent-linking: with no trace head
+ * attached the run is unsampled (`isTraced === false`), so CF records nothing and
+ * its span tree is not introspectable. So `enterSpan`'s ambient-span parent-linking
+ * inside a DO stays unverified upstream, and this remains capability-probed: an
+ * absent/undefined `tracing`, a missing `enterSpan`, or an off-CF/unsampled run all
+ * resolve to `undefined`/no-op — exact prior behavior. If CF's ambient-span linkage
+ * misbehaves in a DO, the worst case is a mis-parented CF span; our own recorded
+ * waterfall is unaffected.
  */
 declare const createTracer: (deps: TracerDeps) => ContextTracer;
 /**
@@ -3736,6 +3749,20 @@ type ContextLogLevel = "debug" | "error" | "fatal" | "info" | "log" | "trace" |
  * `waitUntil` (no request context) means the sink falls back to fire-and-forget.
  */
 interface LogSinkContext {
+  /**
+   * Resolves this request's detected OTLP resource attributes (`service.version`,
+   * `cloud.region`, …) on demand, or absent when the host does not detect any.
+   *
+   * Deliberately a resolved, allowlisted bag behind a thunk rather than the raw
+   * `env` and `Request` the host detected them from: this context is fanned out
+   * to **every** registered sink, including user-authored ones, so anything
+   * reachable here should be assumed to end up in someone's debug log — and raw
+   * `env` is every secret binding, while a raw `Request` carries the caller's
+   * `Authorization` and `Cookie`. The thunk keeps detection lazy (a sink that
+   * does not want resource attributes pays nothing) and hosts are expected to
+   * memoize it per request.
+   */
+  resourceAttributes?: () => Record<string, boolean | number | string>;
   /** Keep a background promise alive past the response (the request's `waitUntil`). */
   waitUntil?: (promise: Promise<unknown>) => void;
 }
@@ -4407,7 +4434,10 @@ interface TelemetrySink {
    * tree on the hosted path — capability-probed, and a safe no-op off-CF / on an
    * older compat date / when unsampled. This only ADDS a CF-side span; the
    * `onSpan` event below (our `SpanBuffer`/`otlpSink`) is unchanged and stays the
-   * source of truth. Mirror of `@lunora/runtime`'s `ObservabilitySink`
+   * source of truth. The bridge is now workerd-validated as available and
+   * side-effect-free inside a real DO (our recorded spans stay intact); CF's
+   * exported parent-linking under sampling is still unverified, so it stays
+   * EXPERIMENTAL. Mirror of `@lunora/runtime`'s `ObservabilitySink`
    * `fuseCloudflareTraces`; see {@link createTracer} for the double-export caveat.
    */
   fuseCloudflareTraces?: boolean;

package/dist/index.d.ts

@@ -2425,8 +2425,11 @@ interface TracerDeps {
    * **custom span**, so it nests inside CF's native binding/fetch/handler trace
    * tree on the hosted path. This only ADDS a CF-side span — the recorded
    * {@link SpanEvent} (our `SpanBuffer`/`otlpSink`) is untouched and remains the
-   * source of truth plus the local studio waterfall. See {@link createTracer}
-   * for the double-export and Durable-Object async-context caveats.
+   * source of truth plus the local studio waterfall. The `enterSpan` call itself
+   * is now workerd-validated as available and side-effect-free inside a Durable
+   * Object; CF's exported parent-linking under sampling remains unverified. See
+   * {@link createTracer} for the double-export and Durable-Object async-context
+   * caveats.
    */
   fuseCloudflareSpans?: boolean;
   /** Hand a finished span to the buffer + sink. */
@@ -2488,12 +2491,22 @@ interface MetricsDeps {
  * pipelines — an intentional, documented trade the operator opts into, not a
  * default.
  *
- * **DO async-context caveat.** `tracing.enterSpan`'s parent-linking inside Durable
- * Objects is unverified upstream, so this is capability-probed: an
- * absent/undefined `tracing`, a missing `enterSpan`, or an off-CF/unsampled run
- * all resolve to `undefined` and the bridge is a total no-op — exact prior
- * behavior. If CF's ambient-span linkage misbehaves in a DO, the worst case is a
- * mis-parented CF span; our own recorded waterfall is unaffected.
+ * **DO async-context caveat (EXPERIMENTAL, partially workerd-validated).**
+ * `tracing.enterSpan` is now confirmed to EXIST and RUN inside a real Durable
+ * Object under `@cloudflare/vitest-pool-workers` (see
+ * `__tests__/workerd/context-telemetry-cf-bridge.workerd.test.ts`): it resolves
+ * from `cloudflare:workers`, its callback executes and returns the body value
+ * without throwing, `span.isTraced` is a real boolean, and — the key additive
+ * guarantee — our recorded {@link SpanEvent} tree (parent/child via the threaded
+ * `parentSpanId`) is byte-for-byte identical with the bridge on vs off. What that
+ * harness CANNOT prove is CF's own *exported* parent-linking: with no trace head
+ * attached the run is unsampled (`isTraced === false`), so CF records nothing and
+ * its span tree is not introspectable. So `enterSpan`'s ambient-span parent-linking
+ * inside a DO stays unverified upstream, and this remains capability-probed: an
+ * absent/undefined `tracing`, a missing `enterSpan`, or an off-CF/unsampled run all
+ * resolve to `undefined`/no-op — exact prior behavior. If CF's ambient-span linkage
+ * misbehaves in a DO, the worst case is a mis-parented CF span; our own recorded
+ * waterfall is unaffected.
  */
 declare const createTracer: (deps: TracerDeps) => ContextTracer;
 /**
@@ -3736,6 +3749,20 @@ type ContextLogLevel = "debug" | "error" | "fatal" | "info" | "log" | "trace" |
  * `waitUntil` (no request context) means the sink falls back to fire-and-forget.
  */
 interface LogSinkContext {
+  /**
+   * Resolves this request's detected OTLP resource attributes (`service.version`,
+   * `cloud.region`, …) on demand, or absent when the host does not detect any.
+   *
+   * Deliberately a resolved, allowlisted bag behind a thunk rather than the raw
+   * `env` and `Request` the host detected them from: this context is fanned out
+   * to **every** registered sink, including user-authored ones, so anything
+   * reachable here should be assumed to end up in someone's debug log — and raw
+   * `env` is every secret binding, while a raw `Request` carries the caller's
+   * `Authorization` and `Cookie`. The thunk keeps detection lazy (a sink that
+   * does not want resource attributes pays nothing) and hosts are expected to
+   * memoize it per request.
+   */
+  resourceAttributes?: () => Record<string, boolean | number | string>;
   /** Keep a background promise alive past the response (the request's `waitUntil`). */
   waitUntil?: (promise: Promise<unknown>) => void;
 }
@@ -4407,7 +4434,10 @@ interface TelemetrySink {
    * tree on the hosted path — capability-probed, and a safe no-op off-CF / on an
    * older compat date / when unsampled. This only ADDS a CF-side span; the
    * `onSpan` event below (our `SpanBuffer`/`otlpSink`) is unchanged and stays the
-   * source of truth. Mirror of `@lunora/runtime`'s `ObservabilitySink`
+   * source of truth. The bridge is now workerd-validated as available and
+   * side-effect-free inside a real DO (our recorded spans stay intact); CF's
+   * exported parent-linking under sampling is still unverified, so it stays
+   * EXPERIMENTAL. Mirror of `@lunora/runtime`'s `ObservabilitySink`
    * `fuseCloudflareTraces`; see {@link createTracer} for the double-export caveat.
    */
   fuseCloudflareTraces?: boolean;

package/dist/index.mjs

@@ -28,7 +28,7 @@ export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_share
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-B4Cpm7Qv.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-B_zt4RQE.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
 export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-iFAA8FbD.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';

package/dist/packem_shared/{ROOT_DO_SIZE_WARN_BYTES-B4Cpm7Qv.mjs → ROOT_DO_SIZE_WARN_BYTES-B_zt4RQE.mjs}

@@ -356,7 +356,11 @@ const runSql$3 = (sql, query, ...parameters) => {
   return runner.call(sql, query, ...parameters);
 };
 const bucketFloor = (ts) => Math.floor(ts / METRIC_HISTORY_BUCKET_MS) * METRIC_HISTORY_BUCKET_MS;
+const ensuredHandles = /* @__PURE__ */ new WeakSet();
 const ensureMetricHistoryTable = (sql) => {
+  if (ensuredHandles.has(sql)) {
+    return;
+  }
   runSql$3(
     sql,
     `CREATE TABLE IF NOT EXISTS "${METRIC_HISTORY_TABLE}" (
@@ -377,12 +381,25 @@ const ensureMetricHistoryTable = (sql) => {
             PRIMARY KEY (series_key, bucket_ms)
         )`
   );
+  ensuredHandles.add(sql);
+};
+const KNOWN_BUCKETS_CAP = 4096;
+const knownBuckets = /* @__PURE__ */ new WeakMap();
+const knownBucketsFor = (sql) => {
+  let set = knownBuckets.get(sql);
+  if (set === void 0) {
+    set = /* @__PURE__ */ new Set();
+    knownBuckets.set(sql, set);
+  }
+  return set;
 };
 const recordMetricHistory = (sql, event, exemplarTraceId) => {
   ensureMetricHistoryTable(sql);
   const key = metricSeriesKey(event);
   const bucket = bucketFloor(event.ts);
-  const bucketExists = runSql$3(sql, `SELECT 1 AS c FROM "${METRIC_HISTORY_TABLE}" WHERE series_key = ? AND bucket_ms = ? LIMIT 1`, key, bucket).toArray().length > 0;
+  const cache = knownBucketsFor(sql);
+  const cacheKey = `${key}\0${bucket.toString()}`;
+  const bucketExists = cache.has(cacheKey) || runSql$3(sql, `SELECT 1 AS c FROM "${METRIC_HISTORY_TABLE}" WHERE series_key = ? AND bucket_ms = ? LIMIT 1`, key, bucket).toArray().length > 0;
   if (!bucketExists) {
     const seriesTracked = runSql$3(sql, `SELECT 1 AS c FROM "${METRIC_HISTORY_TABLE}" WHERE series_key = ? LIMIT 1`, key).toArray().length > 0;
     if (!seriesTracked) {
@@ -434,6 +451,12 @@ const recordMetricHistory = (sql, event, exemplarTraceId) => {
       key
     );
   }
+  if (bucketExists && !cache.has(cacheKey)) {
+    if (cache.size >= KNOWN_BUCKETS_CAP) {
+      cache.clear();
+    }
+    cache.add(cacheKey);
+  }
 };
 const parseAttributes = (raw) => {
   if (raw === "" || raw === "{}") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/do",
-  "version": "1.0.0-alpha.41",
+  "version": "1.0.0-alpha.43",
   "description": "Lunora Durable Objects: ShardDO (SQLite, OCC, hibernated WebSocket subscriptions) and SessionDO",
   "keywords": [
     "cloudflare",