@lunora/queue 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/index.d.ts

@@ -1,9 +1,11 @@
+import { QueueBindingLike, MessageBatchLike, MessageLike, QueueSendOptions, MessageSendRequestLike, QueueSendBatchOptions } from '@lunora/platform';
+export type { MessageBatchLike, MessageLike, MessageSendRequestLike, QueueBindingLike, QueueContentType, QueueRetryOptions, QueueSendBatchOptions, QueueSendOptions } from '@lunora/platform';
 /**
-* Shared types for dispatching a Lunora function back into the worker from a
-* server-initiated context (a workflow body, a queue handler, a scheduled job).
-* Node-safe — no Cloudflare runtime imports — so the consumers stay unit-testable
-* with plain-object doubles.
-*/
+ * Shared types for dispatching a Lunora function back into the worker from a
+ * server-initiated context (a workflow body, a queue handler, a scheduled job).
+ * Node-safe — no Cloudflare runtime imports — so the consumers stay unit-testable
+ * with plain-object doubles.
+ */
 /** Opaque generated function reference (`api.foo.bar`), carrying its dispatch id. */
 interface FunctionReference {
   __lunoraRef: string;
@@ -12,8 +14,45 @@ interface FunctionReference {
 type ArgsOf<F> = F extends FunctionReference ? Record<string, unknown> : never;
 /** Options for a function call made via a dispatch runner. */
 interface RunFunctionOptions {
+  /**
+   * The at-least-once dedup key for THIS ONE CALL, sent to the dispatch
+   * endpoint as the body's `id` and forwarded to the shard as the
+   * replay-dedup `mutationId` — so a redelivery that re-runs the same call
+   * applies it exactly once instead of twice.
+   *
+   * Must be unique per call and stable across redeliveries. It is NOT
+   * {@link RunFunctionOptions.messageId}: the shard's dedup table is keyed
+   * `(identity, mutationId)` with no function path in it, and every
+   * server-initiated dispatch shares the `"system:"` identity, so reusing
+   * one id across two calls makes the second return the FIRST call's cached
+   * result without ever executing. A per-message id is 1:N with the calls a
+   * handler makes; this is 1:1.
+   *
+   * `@lunora/queue`'s `message.run` derives one automatically as
+   * `<messageId>#<n>`, `n` counting that message's calls in order. That is
+   * stable across redeliveries because the handler replays from the start —
+   * it relies on the handler issuing its `run` calls in a DETERMINISTIC
+   * order, which at-least-once replay already assumes. A handler whose call
+   * order varies per attempt (branching on `Date.now()`, `Math.random()`,
+   * or unordered concurrent settles) must pass its own stable ids instead.
+   *
+   * Optional; when omitted the dispatch is at-least-once.
+   */
+  dedupId?: string;
+  /**
+   * Correlate this call with a caller-defined message/item id (e.g. a queue
+   * message's `id`), for failure attribution only — never sent to the
+   * dispatch endpoint. Carried onto the `LunoraError` a deterministic
+   * dispatch failure throws, so a batching consumer (`@lunora/queue`'s push
+   * handler) can read it back and attribute the failure to the one item that
+   * caused it instead of the whole batch. Deliberately NOT the dedup key —
+   * see {@link RunFunctionOptions.dedupId}. Optional and inert when omitted.
+   */
+  messageId?: string;
   /** Route the call to a specific shard (defaults to the worker's root shard). */
   shardKey?: string;
+  /** Abort the dispatch after this many ms; the abort is retryable. Overrides the runner's default. */
+  timeoutMs?: number;
 }
 /** Invoke a Lunora function (query/mutation/action) by reference. The shape of `ctx.run`. */
 type DispatchRunFunction = <F extends FunctionReference>(function_: F, args?: ArgsOf<F>, options?: RunFunctionOptions) => Promise<unknown>;
@@ -24,66 +63,11 @@ interface DispatchLogger {
   info: (message: unknown, ...rest: unknown[]) => void;
   warn: (message: unknown, ...rest: unknown[]) => void;
 }
-/** Build a {@link DispatchLogger} that prefixes every line with `prefix` (e.g. `[queue:email]`). */
-/** How a queue message body is serialized on the wire (Cloudflare default `"json"`). */
-type QueueContentType = "bytes" | "json" | "text" | "v8";
-/** Options for a single `producer.send(body, options?)`. */
-interface QueueSendOptions {
-  /** Wire serialization for this message (defaults to the queue's content type). */
-  contentType?: QueueContentType;
-  /** Per-message delivery delay in seconds (0–43200, i.e. up to 12 hours). */
-  delaySeconds?: number;
-}
-/** Options for a `producer.sendBatch(messages, options?)`. */
-interface QueueSendBatchOptions {
-  /** Delivery delay applied to the whole batch, in seconds. */
-  delaySeconds?: number;
-}
-/** One entry in a `sendBatch` call — a body plus optional per-message overrides. */
-interface MessageSendRequestLike<Body = unknown> {
-  body: Body;
-  contentType?: QueueContentType;
-  delaySeconds?: number;
-}
 /**
-* Minimal structural projection of workers-types' `Queue&lt;Body>` (the producer
-* binding). The real binding's `send`/`sendBatch` resolve to a metadata object;
-* we widen the return to `Promise&lt;unknown>` so a plain-object fake satisfies it.
-*/
-interface QueueBindingLike<Body = unknown> {
-  send: (message: Body, options?: QueueSendOptions) => Promise<unknown>;
-  sendBatch: (messages: Iterable<MessageSendRequestLike<Body>>, options?: QueueSendBatchOptions) => Promise<unknown>;
-}
-/** Options for retrying a message / batch (`message.retry({ delaySeconds })`). */
-interface QueueRetryOptions {
-  delaySeconds?: number;
-}
-/** Structural mirror of workers-types' `Message&lt;Body>` (one delivered message). */
-interface MessageLike<Body = unknown> {
-  /** Acknowledge this message so it is not redelivered. */
-  ack: () => void;
-  readonly attempts: number;
-  readonly body: Body;
-  readonly id: string;
-  /** Explicitly retry this message (optionally after a delay). */
-  retry: (options?: QueueRetryOptions) => void;
-  readonly timestamp: Date;
-}
-/** Structural mirror of workers-types' `MessageBatch&lt;Body>` handed to a consumer. */
-interface MessageBatchLike<Body = unknown> {
-  /** Acknowledge every message in the batch. */
-  ackAll: () => void;
-  readonly messages: ReadonlyArray<MessageLike<Body>>;
-  /** The queue name this batch was delivered from (`batch.queue`), used to route. */
-  readonly queue: string;
-  /** Retry every message in the batch (optionally after a delay). */
-  retryAll: (options?: QueueRetryOptions) => void;
-}
-/**
-* The typed producer bound to `ctx.queues.&lt;name>`. Sending is a side effect, so
-* the generated context exposes this only on `MutationCtx` / `ActionCtx` (never
-* the deterministic `QueryCtx`), mirroring `ctx.scheduler` / `ctx.workflows`.
-*/
+ * The typed producer bound to `ctx.queues.<name>`. Sending is a side effect, so
+ * the generated context exposes this only on `MutationCtx` / `ActionCtx` (never
+ * the deterministic `QueryCtx`), mirroring `ctx.scheduler` / `ctx.workflows`.
+ */
 interface QueueProducer<Body = unknown> {
   /** Enqueue one message. */
   send: (body: Body, options?: QueueSendOptions) => Promise<void>;
@@ -91,10 +75,10 @@ interface QueueProducer<Body = unknown> {
   sendBatch: (messages: Iterable<MessageSendRequestLike<Body>>, options?: QueueSendBatchOptions) => Promise<void>;
 }
 /**
-* `ctx.queues` — the map of declared queue export names → typed producers.
-* Codegen narrows this to the exact export names; the package keeps it open so
-* `createQueues` stays schema-agnostic.
-*/
+ * `ctx.queues` — the map of declared queue export names → typed producers.
+ * Codegen narrows this to the exact export names; the package keeps it open so
+ * `createQueues` stays schema-agnostic.
+ */
 interface Queues {
   [exportName: string]: QueueProducer;
 }
@@ -104,23 +88,49 @@ interface LunoraQueuesOptions {
   bindings: Record<string, QueueBindingLike>;
 }
 /**
-* The context handed to a `defineQueue` handler. Decoupled from `@lunora/server`
-* (like the workflow run context): to touch data, call a Lunora mutation/action
-* via `ctx.run(api.x.y, args)` — the dispatch goes through the same
-* `/_lunora/scheduler/dispatch` path the SchedulerDO and workflows use.
-*/
+ * The context handed to a `defineQueue` handler. Decoupled from `@lunora/server`
+ * (like the workflow run context): to touch data, call a Lunora mutation/action
+ * via `ctx.run(api.x.y, args)` — the dispatch goes through the same
+ * `/_lunora/scheduler/dispatch` path the SchedulerDO and workflows use.
+ */
 interface QueueRunContext {
   /** The worker `env` (bindings + vars). */
   readonly env: Record<string, unknown>;
   /** Queue-name-prefixed logger. */
   readonly log: DispatchLogger;
-  /** Invoke a Lunora function (query/mutation/action) by reference. */
+  /**
+   * Invoke a Lunora function (query/mutation/action) by reference.
+   *
+   * Batch-unaware: a failure it throws is attributed to nothing, so a
+   * deterministic failure retries the whole batch. Inside the `batch.messages`
+   * loop, prefer {@link QueueMessage.run}, which pins the call to its message.
+   */
   readonly run: DispatchRunFunction;
 }
+/**
+ * One delivered message as the push handler sees it: the Cloudflare `Message`
+ * plus `run` — a {@link QueueRunContext.run} pinned to THIS message.
+ *
+ * Prefer `message.run(api.x.y, args)` over `ctx.run(...)` inside the batch
+ * loop. The pin is what lets the dispatcher attribute a deterministic dispatch
+ * failure (400/403/404/422) to the one message that caused it: that message is
+ * acked and every other one is retried, instead of the whole batch being
+ * re-delivered because of a single poison message. A plain `ctx.run` call
+ * carries no message id, so its failure stays unattributed and the whole batch
+ * retries.
+ */
+interface QueueMessage<Body = unknown> extends MessageLike<Body> {
+  /** {@link QueueRunContext.run}, pinned to this message for failure attribution. */
+  readonly run: DispatchRunFunction;
+}
+/** The delivered batch as the push handler sees it — {@link QueueMessage}s rather than bare `Message`s. */
+interface QueueMessageBatch<Body = unknown> extends Omit<MessageBatchLike<Body>, "messages"> {
+  readonly messages: ReadonlyArray<QueueMessage<Body>>;
+}
 /** Whether a declared queue is consumed by this worker (push) or polled externally (pull). */
 type QueueConsumerMode = "pull" | "push";
 /** The handler body run for each delivered batch (push consumers only). */
-type QueueHandler<Body = unknown> = (context: QueueRunContext, batch: MessageBatchLike<Body>) => Promise<void> | void;
+type QueueHandler<Body = unknown> = (context: QueueRunContext, batch: QueueMessageBatch<Body>) => Promise<void> | void;
 /** Push-consumer batch/retry tuning, mirrored onto the wrangler `queues.consumers[]` entry. */
 interface QueueConsumerTuning {
   /** Name of the dead-letter queue messages land in after `maxRetries`. */
@@ -137,25 +147,25 @@ interface QueueConsumerTuning {
 /** The config object passed to `defineQueue`. */
 interface QueueConfig<Body = unknown> extends QueueConsumerTuning {
   /**
-  * The push-consumer body. Required for `mode: "push"` (the default); omit it
-  * for `mode: "pull"`, where an external worker polls the queue over HTTP.
-  */
+   * The push-consumer body. Required for `mode: "push"` (the default); omit it
+   * for `mode: "pull"`, where an external worker polls the queue over HTTP.
+   */
   handler?: QueueHandler<Body>;
   /** How this queue is consumed. Defaults to `"push"`. */
   mode?: QueueConsumerMode;
   /**
-  * Stable wrangler queue name (`queues.producers[].queue`). Defaults to the
-  * kebab-cased export name (`emailQueue` → `email-queue`).
-  */
+   * Stable wrangler queue name (`queues.producers[].queue`). Defaults to the
+   * kebab-cased export name (`emailQueue` → `email-queue`).
+   */
   name?: string;
 }
 /** The branded result of `defineQueue`, discovered by codegen + config. */
 interface QueueDefinition<Body = unknown> extends QueueConfig<Body> {
   /**
-  * Phantom carrier for the message body type, so codegen can type the
-  * generated `ctx.queues.&lt;name>` producer as `QueueProducer&lt;Body>` from
-  * `typeof &lt;export>`. Never assigned at runtime (type-only).
-  */
+   * Phantom carrier for the message body type, so codegen can type the
+   * generated `ctx.queues.<name>` producer as `QueueProducer<Body>` from
+   * `typeof <export>`. Never assigned at runtime (type-only).
+   */
   readonly __lunoraBody?: Body;
   /** Runtime brand identifying a `defineQueue` result. */
   isLunoraQueue: true;
@@ -172,13 +182,13 @@ interface QueueBindingSpec {
 /** One declared queue, keyed for batch routing by its stable wrangler name. */
 interface QueueRegistryEntry {
   /**
-  * The `defineQueue` result (carries the push handler). The body type is
-  * erased to `any` here because the registry is heterogeneous — different
-  * queues carry different message bodies, and the handler param is
-  * contravariant, so a precise `QueueDefinition&lt;Body>` would not be assignable
-  * to a shared `unknown`-bodied slot. Runtime dispatch passes the delivered
-  * batch straight through, so the erasure is type-only.
-  */
+   * The `defineQueue` result (carries the push handler). The body type is
+   * erased to `any` here because the registry is heterogeneous — different
+   * queues carry different message bodies, and the handler param is
+   * contravariant, so a precise `QueueDefinition<Body>` would not be assignable
+   * to a shared `unknown`-bodied slot. Runtime dispatch passes the delivered
+   * batch straight through, so the erasure is type-only.
+   */
   definition: QueueDefinition<any>;
   /** The `lunora/queues.ts` export name, for log correlation. */
   exportName: string;
@@ -188,17 +198,17 @@ type QueueRegistry = Record<string, QueueRegistryEntry>;
 /** The disposition a consumer left one message in for a single delivery attempt. */
 type QueueMessageOutcome = "ack" | "error" | "retry";
 /**
-* One consumed message as captured by {@link dispatchQueueBatch} and handed to an
-* {@link QueueCaptureSink}. Structurally matches `@lunora/do`'s
-* `RecordQueueMessageInput` (the reserved `recordQueueMessage` admin RPC payload);
-* the two packages share only this contract, so keep them in sync by hand.
-*/
+ * One consumed message as captured by {@link dispatchQueueBatch} and handed to an
+ * {@link QueueCaptureSink}. Structurally matches `@lunora/do`'s
+ * `RecordQueueMessageInput` (the reserved `recordQueueMessage` admin RPC payload);
+ * the two packages share only this contract, so keep them in sync by hand.
+ */
 interface CapturedQueueMessage {
   /** Delivery attempt number for this message (`message.attempts`). */
   attempts: number;
   /** The message body (JSON-encoded + capped by the catcher). */
   body: unknown;
-  /** `true` when this non-ack disposition exhausted the queue's `maxRetries` (dead-letters next). */
+  /** `true` when this failed delivery was the message's last (its retries are exhausted — the broker dead-letters it). */
   deadLettered: boolean;
   /** Handler error message when `outcome` is `error`; absent otherwise. */
   error?: string;
@@ -214,19 +224,20 @@ interface CapturedQueueMessage {
   timestamp: number;
 }
 /**
-* Persists a batch of consumed messages. The codegen worker wires this to POST the
-* batch to the root shard's `recordQueueMessage` admin RPC (the dev queue catcher).
-* Best-effort by contract: {@link dispatchQueueBatch} swallows a rejection so a
-* capture failure never changes delivery semantics.
-*/
+ * Persists a batch of consumed messages. The codegen worker wires this to POST the
+ * batch to the root shard's `recordQueueMessage` admin RPC (the dev queue catcher).
+ * Best-effort by contract: {@link dispatchQueueBatch} swallows a rejection so a
+ * capture failure never changes delivery semantics.
+ */
 type QueueCaptureSink = (messages: CapturedQueueMessage[]) => Promise<void> | void;
 interface DispatchOptions {
   /**
-  * Optional capture sink. When set, the batch is instrumented and every
-  * message's final disposition is recorded and handed to this sink after the
-  * handler runs. Omitted in production unless queue capture is enabled, so a
-  * consumer pays no instrumentation cost by default.
-  */
+   * Optional capture sink. When set, every message's final disposition is
+   * turned into a record and handed to this sink after the handler runs.
+   * Omitted in production unless queue capture is enabled, so a consumer pays
+   * no record-building or sink cost by default. Delivery semantics — including
+   * poison-message isolation — do not depend on it.
+   */
   capture?: QueueCaptureSink;
   /** Worker `env`, forwarded to the queue run context. */
   env: Record<string, unknown>;
@@ -234,11 +245,11 @@ interface DispatchOptions {
   fetchImpl?: typeof fetch;
 }
 /**
-* Look up the handler for `batch.queue` and invoke it with a fresh
-* `QueueRunContext`. Throws a directed error when no push handler is registered
-* for the delivered queue (a misconfiguration — the consumer was declared
-* `pull`, or the queue name drifted from the `defineQueue` export).
-*/
+ * Look up the handler for `batch.queue` and invoke it with a fresh
+ * `QueueRunContext`. Throws a directed error when no push handler is registered
+ * for the delivered queue (a misconfiguration — the consumer was declared
+ * `pull`, or the queue name drifted from the `defineQueue` export).
+ */
 declare const dispatchQueueBatch: (batch: MessageBatchLike, registry: QueueRegistry, options: DispatchOptions) => Promise<void>;
 /** A Worker `env` projected as a plain record (vars, secrets, and bindings are `unknown`-valued). */
 type QueueEnv = Record<string, unknown>;
@@ -250,81 +261,87 @@ interface QueueCaptureOptions {
   rootShard?: string;
 }
 /**
-* Whether consumed queue messages should be captured into the studio's log.
-* Explicit `LUNORA_QUEUE_CAPTURE` (`"1"`/`"true"` vs `"0"`/`"false"`) always wins;
-* unset, capture is on only in a development environment. Mirrors
-* `@lunora/mail`'s `shouldCaptureMail` so mail and queue dev capture toggle the
-* same way.
-*/
+ * Whether consumed queue messages should be captured into the studio's log.
+ * Explicit `LUNORA_QUEUE_CAPTURE` (`"1"`/`"true"` vs `"0"`/`"false"`) always wins;
+ * unset, capture is on only in a development environment. Mirrors
+ * `@lunora/mail`'s `shouldCaptureMail` so mail and queue dev capture toggle the
+ * same way.
+ */
 declare const shouldCaptureQueue: (env: QueueEnv) => boolean;
 /**
-* Build the {@link QueueCaptureSink} that records a processed batch into the
-* studio's root-shard consumed-message log via the reserved `recordQueueMessage`
-* admin RPC. Best-effort by contract: without the `SHARD` binding or
-* `LUNORA_ADMIN_TOKEN` it no-ops, and `dispatchQueueBatch` swallows a
-* rejection, so capture never changes delivery semantics.
-*/
+ * Build the {@link QueueCaptureSink} that records a processed batch into the
+ * studio's root-shard consumed-message log via the reserved `recordQueueMessage`
+ * admin RPC. Best-effort by contract: without the `SHARD` binding or
+ * `LUNORA_ADMIN_TOKEN` it no-ops, and `dispatchQueueBatch` swallows a
+ * rejection, so capture never changes delivery semantics.
+ */
 declare const createQueueCaptureSink: (env: QueueEnv, options?: QueueCaptureOptions) => QueueCaptureSink;
 /**
-* Build the `ctx.queues` map for a request: resolve every spec's `env[binding]`
-* into the `exportName → Queue binding` map and wrap it in {@link createQueues}.
-* A spec whose binding is absent from `env` is skipped here — the helpful "no
-* queue named …" error is raised lazily by `ctx.queues.&lt;name>.send(...)` when
-* the missing queue is actually used.
-*/
+ * Build the `ctx.queues` map for a request: resolve every spec's `env[binding]`
+ * into the `exportName → Queue binding` map and wrap it in {@link createQueues}.
+ * A spec whose binding is absent from `env` is skipped here — the helpful "no
+ * queue named …" error is raised lazily by `ctx.queues.<name>.send(...)` when
+ * the missing queue is actually used.
+ */
 declare const createQueueContext: (env: Record<string, unknown>, specs: ReadonlyArray<QueueBindingSpec>) => Queues;
 /**
-* Build the `ctx.queues` map from `lunora/queues.ts` export name → Cloudflare
-* `Queue` binding. Each property is a typed {@link QueueProducer}; accessing an
-* export whose binding is absent throws a directed error naming the declared
-* queues (raised lazily on first use).
-*/
+ * Build the `ctx.queues` map from `lunora/queues.ts` export name → Cloudflare
+ * `Queue` binding. Each property is a typed {@link QueueProducer}; accessing an
+ * export whose binding is absent throws a directed error naming the declared
+ * queues (raised lazily on first use).
+ */
 declare const createQueues: (options: LunoraQueuesOptions) => Queues;
 /**
-* The wrangler producer binding name for a queue export: `emailQueue` →
-* `QUEUE_EMAIL_QUEUE`, `email` → `QUEUE_EMAIL`. The `QUEUE_` prefix namespaces
-* these away from `SHARD`/`SESSION`/`SCHEDULER`/`WORKFLOW_*`/`CONTAINER_*` so a
-* queue export can never collide with the built-in bindings.
-*/
+ * The wrangler producer binding name for a queue export: `emailQueue` →
+ * `QUEUE_EMAIL_QUEUE`, `email` → `QUEUE_EMAIL`. The `QUEUE_` prefix namespaces
+ * these away from `SHARD`/`SESSION`/`SCHEDULER`/`WORKFLOW_*`/`CONTAINER_*` so a
+ * queue export can never collide with the built-in bindings.
+ */
 declare const queueBindingName: (exportName: string) => string;
 /**
-* The stable queue name wrangler registers (`queues.producers[].queue` and
-* `queues.consumers[].queue`): `emailQueue` → `email-queue`. Used as the
-* deployed queue's identifier when no explicit `name` override is given.
-*/
+ * The stable queue name wrangler registers (`queues.producers[].queue` and
+ * `queues.consumers[].queue`): `emailQueue` → `email-queue`. Used as the
+ * deployed queue's identifier when no explicit `name` override is given.
+ */
 declare const queueDefaultName: (exportName: string) => string;
 /**
-* Declare a Cloudflare Queue deployed alongside the app. Pure validation +
-* branding: codegen discovers the export, emits the typed `ctx.queues.&lt;name>`
-* producer and (for push consumers) the worker `queue()` dispatch; the config
-* layer reconciles the wrangler `queues.producers[]` / `queues.consumers[]`
-* entries from the same definition.
-*
-* ```ts
-* // lunora/queues.ts
-* import { defineQueue } from "@lunora/queue";
-* import { api } from "./_generated/api";
-*
-* export const emailQueue = defineQueue&lt;{ to: string }>({
-*     handler: async (ctx, batch) => {
-*         for (const message of batch.messages) {
-*             await ctx.run(api.email.send, { to: message.body.to });
-*             message.ack();
-*         }
-*     },
-* });
-* ```
-*
-* Enqueue from a mutation or action: `await ctx.queues.emailQueue.send({ to })`.
-*
-* ⚠️ **Privileged dispatch.** A push handler's `ctx.run(...)` calls back into
-* Lunora functions over the admin-authenticated dispatch endpoint (the same
-* trusted path the scheduler and workflows use), so those calls run with the
-* system identity — **end-user RLS is not applied**. Treat a queue handler as
-* trusted server code: validate `message.body` (it may be attacker-influenced if
-* anything user-facing can enqueue) before acting on it, and don't forward an
-* unchecked body straight into a privileged mutation.
-*/
+ * Declare a Cloudflare Queue deployed alongside the app. Pure validation +
+ * branding: codegen discovers the export, emits the typed `ctx.queues.<name>`
+ * producer and (for push consumers) the worker `queue()` dispatch; the config
+ * layer reconciles the wrangler `queues.producers[]` / `queues.consumers[]`
+ * entries from the same definition.
+ *
+ * ```ts
+ * // lunora/queues.ts
+ * import { defineQueue } from "@lunora/queue";
+ * import { api } from "./_generated/api";
+ *
+ * export const emailQueue = defineQueue<{ to: string }>({
+ *     handler: async (ctx, batch) => {
+ *         for (const message of batch.messages) {
+ *             await message.run(api.email.send, { to: message.body.to });
+ *             message.ack();
+ *         }
+ *     },
+ * });
+ * ```
+ *
+ * Enqueue from a mutation or action: `await ctx.queues.emailQueue.send({ to })`.
+ *
+ * `message.run(...)` is `ctx.run(...)` pinned to that message — prefer it inside
+ * the batch loop. A deterministic failure (400/403/404/422) from a pinned call
+ * is attributed to its message: that one is acked and the rest are retried,
+ * instead of one poison message re-delivering (and eventually dead-lettering)
+ * the whole batch.
+ *
+ * ⚠️ **Privileged dispatch.** A push handler's `ctx.run(...)` calls back into
+ * Lunora functions over the admin-authenticated dispatch endpoint (the same
+ * trusted path the scheduler and workflows use), so those calls run with the
+ * system identity — **end-user RLS is not applied**. Treat a queue handler as
+ * trusted server code: validate `message.body` (it may be attacker-influenced if
+ * anything user-facing can enqueue) before acting on it, and don't forward an
+ * unchecked body straight into a privileged mutation.
+ */
 declare const defineQueue: <Body = unknown>(config: QueueConfig<Body>) => QueueDefinition<Body>;
 /** True when a value is a `defineQueue` result (the runtime brand check). */
 declare const isQueueDefinition: (value: unknown) => value is QueueDefinition;
@@ -335,4 +352,4 @@ interface RunContextOptions {
 }
 /** Assemble the {@link QueueRunContext} passed to a `defineQueue` handler. */
 declare const createQueueRunContext: (options: RunContextOptions) => QueueRunContext;
-export { type ArgsOf, type CapturedQueueMessage, type FunctionReference, type LunoraQueuesOptions, type MessageBatchLike, type MessageLike, type MessageSendRequestLike, type QueueBindingLike, type QueueBindingSpec, type QueueCaptureOptions, type QueueCaptureSink, type QueueConfig, type QueueConsumerMode, type QueueConsumerTuning, type QueueContentType, type QueueDefinition, type QueueEnv, type QueueHandler, type DispatchLogger as QueueLogger, type QueueProducer, type QueueRegistry, type QueueRegistryEntry, type QueueRetryOptions, type QueueRunContext, type DispatchRunFunction as QueueRunFunction, type QueueSendBatchOptions, type QueueSendOptions, type Queues, type RunFunctionOptions, createQueueCaptureSink, createQueueContext, createQueueRunContext, createQueues, defineQueue, dispatchQueueBatch, isQueueDefinition, queueBindingName, queueDefaultName, shouldCaptureQueue };
+export { type ArgsOf, type CapturedQueueMessage, type FunctionReference, type LunoraQueuesOptions, type QueueBindingSpec, type QueueCaptureOptions, type QueueCaptureSink, type QueueConfig, type QueueConsumerMode, type QueueConsumerTuning, type QueueDefinition, type QueueEnv, type QueueHandler, type DispatchLogger as QueueLogger, type QueueMessage, type QueueMessageBatch, type QueueProducer, type QueueRegistry, type QueueRegistryEntry, type QueueRunContext, type DispatchRunFunction as QueueRunFunction, type Queues, type RunFunctionOptions, createQueueCaptureSink, createQueueContext, createQueueRunContext, createQueues, defineQueue, dispatchQueueBatch, isQueueDefinition, queueBindingName, queueDefaultName, shouldCaptureQueue };

package/dist/index.mjs

@@ -1,6 +1 @@
-export { createQueueCaptureSink, shouldCaptureQueue } from './packem_shared/createQueueCaptureSink-CRacRMqV.mjs';
-export { createQueueContext } from './packem_shared/createQueueContext-D0XCdCsd.mjs';
-export { default as createQueues } from './packem_shared/createQueues-14-vSICK.mjs';
-export { defineQueue, isQueueDefinition, queueBindingName, queueDefaultName } from './packem_shared/defineQueue-D40gREfg.mjs';
-export { dispatchQueueBatch } from './packem_shared/dispatchQueueBatch-D4zU7C-C.mjs';
-export { createQueueRunContext } from './packem_shared/createQueueRunContext-_2hD-TK7.mjs';
+import{createQueueCaptureSink as t,shouldCaptureQueue as r}from"./packem_shared/createQueueCaptureSink-CSOPftvj.mjs";import{createQueueContext as a}from"./packem_shared/createQueueContext-B9PgIzBM.mjs";import{default as i}from"./packem_shared/createQueues-FpKDoLFX.mjs";import{defineQueue as p,isQueueDefinition as m,queueBindingName as x,queueDefaultName as Q}from"./packem_shared/defineQueue-TY4-i3nG.mjs";import{dispatchQueueBatch as s}from"./packem_shared/dispatchQueueBatch-x_PWzYXq.mjs";import{c as C}from"./packem_shared/run-context-Bz18TJFU.mjs";export{t as createQueueCaptureSink,a as createQueueContext,C as createQueueRunContext,i as createQueues,p as defineQueue,s as dispatchQueueBatch,m as isQueueDefinition,x as queueBindingName,Q as queueDefaultName,r as shouldCaptureQueue};

package/dist/packem_shared/createQueueCaptureSink-CSOPftvj.mjs

@@ -0,0 +1 @@
+import{LunoraError as E}from"@lunora/errors";const _="__lunora_admin__:recordQueueMessage",N="__root__",f=/^(?:dev(?:elopment)?|local(?:host)?|test)$/iu,p=["CF_ENV","ENVIRONMENT","NODE_ENV","WORKER_ENV"],T=5e3,O=o=>{const t=o.LUNORA_QUEUE_CAPTURE;if(typeof t=="string"){const e=t.toLowerCase();if(e==="1"||e==="true")return!0;if(e==="0"||e==="false")return!1;console.warn(`@lunora/queue: unrecognized LUNORA_QUEUE_CAPTURE value "${t}" — expected "1"/"true" or "0"/"false"; falling back to environment detection.`)}return p.some(e=>{const r=o[e];return typeof r=="string"&&f.test(r)})},h=(o,t={})=>{const e=t.rootShard??N;return async r=>{if(r.length===0)return;const i=o.SHARD,s=typeof o.LUNORA_ADMIN_TOKEN=="string"?o.LUNORA_ADMIN_TOKEN:void 0;if(i===void 0||s===void 0)return;let a=i;if(t.jurisdiction!==void 0){if(typeof i.jurisdiction!="function")throw new TypeError(`@lunora/queue: Durable Object namespace does not support jurisdiction("${t.jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`);a=i.jurisdiction(t.jurisdiction)}const l=a.get(a.idFromName(e)),u=new AbortController,d=setTimeout(()=>{u.abort()},T);try{const n=await l.fetch("https://shard.internal/rpc",{body:JSON.stringify({args:{messages:r},functionPath:_}),headers:{authorization:`Bearer ${s}`,"content-type":"application/json"},method:"POST",signal:u.signal});if(!n.ok){const c=await n.text().catch(()=>"");throw new E("INTERNAL",`@lunora/queue: capture write to the root shard failed (${String(n.status)} ${n.statusText})${c===""?"":`: ${c}`}`)}await n.body?.cancel()}finally{clearTimeout(d)}}};export{h as createQueueCaptureSink,O as shouldCaptureQueue};

package/dist/packem_shared/createQueueContext-B9PgIzBM.mjs

@@ -0,0 +1 @@
+import i from"./createQueues-FpKDoLFX.mjs";const s=(o,c)=>{const n={};for(const t of c){const e=o[t.binding];e&&typeof e.send=="function"&&typeof e.sendBatch=="function"&&(n[t.exportName]=e)}return i({bindings:n})};export{s as createQueueContext};

package/dist/packem_shared/createQueueRunContext-ZSWNee5A.mjs

@@ -0,0 +1 @@
+import{c as o}from"./run-context-Bz18TJFU.mjs";export{o as createQueueRunContext};

package/dist/packem_shared/createQueues-FpKDoLFX.mjs

@@ -0,0 +1 @@
+import{LunoraError as i}from"@lunora/errors";const u=100,d=o=>({send:async(r,n)=>{await o.send(r,n)},sendBatch:async(r,n)=>{const t=[...r];if(t.length>u)throw new i("VALIDATION_ERROR",`@lunora/queue: sendBatch exceeds ${String(u)} (got ${String(t.length)}) — split across calls`);await o.sendBatch(t,n)}}),g=o=>{const r=o.bindings??{},n=Object.create(null);for(const[s,e]of Object.entries(r))n[s]=d(e);const t=Object.keys(n),a=s=>{const e=t.length===0?"no queues are declared":`known queues: ${t.join(", ")}`,c=()=>Promise.reject(new Error(`@lunora/queue: no queue named "${s}" (${e})`));return{send:c,sendBatch:c}};return new Proxy(n,{get(s,e){if(typeof e=="string")return Object.hasOwn(s,e)?s[e]:a(e)}})};export{g as default};

package/dist/packem_shared/defineQueue-TY4-i3nG.mjs

@@ -0,0 +1 @@
+const n=e=>`QUEUE_${e.replaceAll(/(?<=[a-z0-9])(?=[A-Z])/g,"_").toUpperCase()}`,t=e=>e.replaceAll(/(?<=[a-z0-9])(?=[A-Z])/g,"-").toLowerCase(),o=e=>{const u=e.mode??"push";if(u!=="push"&&u!=="pull")throw new TypeError(`defineQueue: \`mode\` must be "push" or "pull" (got ${JSON.stringify(e.mode)})`);if(u==="push"&&typeof e.handler!="function")throw new TypeError('defineQueue: `handler` must be a function for a push consumer (omit it only when `mode: "pull"`)');if(e.name!==void 0&&(typeof e.name!="string"||e.name.length===0))throw new TypeError("defineQueue: `name` must be a non-empty string when provided");return{...e,isLunoraQueue:!0,mode:u}},r=e=>typeof e=="object"&&e!==null&&e.isLunoraQueue===!0;export{o as defineQueue,r as isQueueDefinition,n as queueBindingName,t as queueDefaultName};

package/dist/packem_shared/dispatchQueueBatch-x_PWzYXq.mjs

@@ -0,0 +1 @@
+import{c as m,B as w,M as h}from"./run-context-Bz18TJFU.mjs";import{LunoraError as y,toErrorBody as v}from"@lunora/errors";const x=3,q=e=>{if(e instanceof Date)return e.getTime();const r=typeof e=="number"?e:Number(e);return Number.isFinite(r)?r:0},b=(e,r)=>{let t=0;return(n,o,i)=>(t+=1,e(n,o,{...i,dedupId:`${r}#${String(t)}`,messageId:r}))},k=(e,r,t)=>{const n=b(t,e.id);return new Proxy(e,{get:(o,i)=>i==="ack"?()=>{r.set(o,"ack"),o.ack()}:i==="retry"?c=>{r.set(o,"retry"),o.retry(c)}:i==="run"?n:Reflect.get(o,i,o)})},g=(e,r,t)=>new Proxy(e,{get:(n,o)=>o==="ackAll"?()=>{t("ack"),n.ackAll()}:o==="retryAll"?i=>{t("retry"),n.retryAll(i)}:o==="messages"?r:Reflect.get(n,o,n)}),N=(e,r)=>{const t=new Map,n=e.messages,o=n.map(a=>k(a,t,r)),c=g(e,o,a=>{for(const d of n)t.has(d)||t.set(d,a)});return{dispositions:t,originals:n,wrappedBatch:c}},$=e=>{if(e instanceof Error)return e.message;if(typeof e=="string")return e;if(e!==null&&typeof e=="object")try{return JSON.stringify(e)}catch{return"[unserializable thrown value]"}return String(e)},R=(e,r,t,n,o,i)=>{const c=n?$(o):void 0,a=typeof r.definition.maxRetries=="number"?r.definition.maxRetries:x,d=n?"error":"ack";return e.originals.map(s=>{const l=s===i,u=e.dispositions.get(s),f=l?"error":u??d,p=typeof s.attempts=="number"?s.attempts:1;return{attempts:p,body:s.body,deadLettered:!l&&f!=="ack"&&p>a,error:f==="error"?c:void 0,exportName:r.exportName,messageId:s.id,outcome:f,queue:t,timestamp:q(s.timestamp)}})},A=(e,r,t)=>{if(!r||!w(t))return;const n=h(t);if(n===void 0)return;const o=e.originals.find(i=>i.id===n);if(!(o===void 0||e.dispositions.has(o)))return o},M=(e,r)=>{r.ack();for(const t of e.originals)t!==r&&!e.dispositions.has(t)&&(e.dispositions.set(t,"retry"),t.retry())},I=async(e,r,t)=>{const n=Object.hasOwn(r,e.queue)?r[e.queue]:void 0;if(n===void 0){const u=Object.keys(r),f=u.length===0?"no push queues are declared":`known push queues: ${u.join(", ")}`;throw new y("INTERNAL",`@lunora/queue: received a batch for queue "${e.queue}" but no push handler is registered (${f})`)}const{handler:o}=n.definition;if(typeof o!="function")throw new TypeError(`@lunora/queue: queue "${e.queue}" (${n.exportName}) has no push handler — it is declared as a pull consumer`);const i=m({env:t.env,exportName:n.exportName,fetchImpl:t.fetchImpl}),c=N(e,i.run);let a=!1,d;try{await o(i,c.wrappedBatch)}catch(u){a=!0,d=u}const s=A(c,a,d);if(s!==void 0){M(c,s);const{body:u,status:f}=v(d,{redactedMessage:"internal error"});console.error(`@lunora/queue: dropped message ${s.id} on queue "${e.queue}" (${n.exportName}) — a dispatch it made failed with a deterministic ${String(f)} (${u.code}: ${u.message}), so it was acked, not retried. Its retries are NOT exhausted and it is not dead-lettered — it will never be redelivered.`)}const l=a&&s===void 0;if(t.capture!==void 0)try{await t.capture(R(c,n,e.queue,a,d,s))}catch(u){console.warn("@lunora/queue: capture sink failed (delivery unaffected):",u)}if(l)throw d};export{I as dispatchQueueBatch};

package/dist/packem_shared/run-context-Bz18TJFU.mjs

@@ -0,0 +1 @@
+import{LunoraError as d,isLunoraError as A}from"@lunora/errors";const R=t=>({debug:(e,...n)=>{console.debug(t,e,...n)},error:(e,...n)=>{console.error(t,e,...n)},info:(e,...n)=>{console.info(t,e,...n)},warn:(e,...n)=>{console.warn(t,e,...n)}}),E=(t,e,n)=>{if(e===void 0)return{dispose:()=>{},signal:t};const s=new AbortController,o=setTimeout(()=>{s.abort(n())},e);return{dispose:()=>{clearTimeout(o)},signal:s.signal}},a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_",b=t=>{let e="",n=0;const s=t.length-2;for(;n<s;n+=3){const r=t[n]<<16|t[n+1]<<8|t[n+2];e+=a.charAt(r>>18&63)+a.charAt(r>>12&63)+a.charAt(r>>6&63)+a.charAt(r&63)}const o=t.length-n;if(o===1){const r=t[n]<<16;e+=a.charAt(r>>18&63)+a.charAt(r>>12&63)}else if(o===2){const r=t[n]<<16|t[n+1]<<8;e+=a.charAt(r>>18&63)+a.charAt(r>>12&63)+a.charAt(r>>6&63)}return e};new TextDecoder;const I=new TextEncoder,N="=",L=t=>{for(let e=0;e<t.length;e+=1)if(t.charCodeAt(e)>255)return!1;return!0},_=t=>b(I.encode(JSON.stringify(t))),S=t=>!t.startsWith(N)&&L(t)?t:`${N}${b(I.encode(t))}`,x="/_lunora/scheduler/dispatch",D=3e4,U=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},v=Symbol("lunoraDispatchFailure"),$=Symbol("lunoraDispatchMessageId"),w=(t,e)=>(Object.defineProperty(t,v,{value:!0}),e!==void 0&&Object.defineProperty(t,$,{value:e}),t),C=t=>A(t)?t[$]:void 0,M=(t,e,n,s)=>{try{const o=JSON.parse(n)?.error;if(typeof o=="object"&&o!==null&&typeof o.code=="string"){const{code:r,data:u,message:l}=o;return w(new d(r,typeof l=="string"?l:void 0,{data:u,status:e}),s)}}catch{}return w(new d("INTERNAL",`${t}: function dispatch failed (${String(e)}): ${n}`,{status:e}),s)},J=new Set([400,403,404,422]),K=t=>A(t)&&t[v]===!0&&J.has(t.status),P=(t,e,n)=>new d("INTERNAL",`${t}: function dispatch to "${e}" timed out after ${String(n)}ms`,{status:503}),j=t=>{const{label:e}=t,n=globalThis.fetch,s=t.fetchImpl??(typeof n=="function"?n.bind(globalThis):void 0);return async(o,r,u={})=>{if(typeof s!="function")throw new TypeError(`${e}: no fetch implementation available — pass fetchImpl or run on a platform with global fetch`);const l=t.env.LUNORA_ORIGIN_URL;if(typeof l!="string"||l.length===0)throw new d("INTERNAL",`${e}: \`LUNORA_ORIGIN_URL\` must be set on the Worker env so a handler can call back into Lunora functions`);const f=t.env.LUNORA_ADMIN_TOKEN;if(typeof f!="string"||f.length===0)throw new d("INTERNAL",`${e}: \`LUNORA_ADMIN_TOKEN\` must be set on the Worker env to authenticate function dispatch`);const O=`${U(l)}${x}`,p={authorization:`Bearer ${f}`,"content-type":"application/json"};t.identity?.userId!==void 0&&(p["x-lunora-userid"]=S(t.identity.userId)),t.identity?.claims!==void 0&&(p["x-lunora-identity"]=_(t.identity.claims));const g=u.timeoutMs??D,m=E(void 0,g,()=>new DOMException(`dispatch timed out after ${String(g)}ms`,"TimeoutError")),y=c=>{throw c instanceof Error&&c.name==="TimeoutError"?P(e,o.__lunoraRef,g):c};let i;try{try{i=await s(O,{body:JSON.stringify({args:r??{},functionPath:o.__lunoraRef,id:u.dedupId,shardKey:u.shardKey}),headers:p,method:"POST",signal:m.signal})}catch(h){return y(h)}if(!i.ok){let h;try{h=await i.text()}catch(T){return y(T)}throw M(e,i.status,h,u.messageId)}let c;try{c=await i.text()}catch(h){return y(h)}if(c.length===0)return;try{return JSON.parse(c)}catch{throw new d("INTERNAL",`${e}: function dispatch returned a non-JSON body (${String(i.status)}): ${c}`,{status:i.status})}}finally{m.dispose()}}},W=t=>({env:t.env,log:R(`[queue:${t.exportName}]`),run:j({env:t.env,fetchImpl:t.fetchImpl,label:"@lunora/queue"})});export{K as B,C as M,W as c};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/queue",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.41",
   "description": "Cloudflare Queues for Lunora: defineQueue producers + consumers, the ctx.queues surface, and the generated queue() worker handler",
   "keywords": [
     "background-jobs",
@@ -44,7 +44,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.1"
+    "@lunora/errors": "1.0.0-alpha.28",
+    "@lunora/platform": "1.0.0-alpha.23"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"

package/dist/packem_shared/createQueueCaptureSink-CRacRMqV.mjs

@@ -1,54 +0,0 @@
-const RECORD_QUEUE_MESSAGE_OP = "__lunora_admin__:recordQueueMessage";
-const DEFAULT_ROOT_SHARD = "__root__";
-const DEV_ENVIRONMENT_PATTERN = /^(?:dev(?:elopment)?|local(?:host)?|test)$/iu;
-const ENVIRONMENT_VARS = ["CF_ENV", "ENVIRONMENT", "NODE_ENV", "WORKER_ENV"];
-const CAPTURE_FETCH_TIMEOUT_MS = 5e3;
-const shouldCaptureQueue = (env) => {
-  const flag = env["LUNORA_QUEUE_CAPTURE"];
-  if (typeof flag === "string") {
-    return flag === "1" || flag.toLowerCase() === "true";
-  }
-  return ENVIRONMENT_VARS.some((key) => {
-    const value = env[key];
-    return typeof value === "string" && DEV_ENVIRONMENT_PATTERN.test(value);
-  });
-};
-const createQueueCaptureSink = (env, options = {}) => {
-  const rootShard = options.rootShard ?? DEFAULT_ROOT_SHARD;
-  return async (messages) => {
-    if (messages.length === 0) {
-      return;
-    }
-    const binding = env["SHARD"];
-    const adminToken = typeof env["LUNORA_ADMIN_TOKEN"] === "string" ? env["LUNORA_ADMIN_TOKEN"] : void 0;
-    if (binding === void 0 || adminToken === void 0) {
-      return;
-    }
-    let namespace = binding;
-    if (options.jurisdiction !== void 0) {
-      if (typeof binding.jurisdiction !== "function") {
-        throw new TypeError(
-          `@lunora/queue: Durable Object namespace does not support jurisdiction("${options.jurisdiction}") — update @cloudflare/workers-types or remove the jurisdiction option`
-        );
-      }
-      namespace = binding.jurisdiction(options.jurisdiction);
-    }
-    const stub = namespace.get(namespace.idFromName(rootShard));
-    const controller = new AbortController();
-    const timeout = setTimeout(() => {
-      controller.abort();
-    }, CAPTURE_FETCH_TIMEOUT_MS);
-    try {
-      await stub.fetch("https://shard.internal/rpc", {
-        body: JSON.stringify({ args: { messages }, functionPath: RECORD_QUEUE_MESSAGE_OP }),
-        headers: { authorization: `Bearer ${adminToken}`, "content-type": "application/json" },
-        method: "POST",
-        signal: controller.signal
-      });
-    } finally {
-      clearTimeout(timeout);
-    }
-  };
-};
-
-export { createQueueCaptureSink, shouldCaptureQueue };

package/dist/packem_shared/createQueueContext-D0XCdCsd.mjs

@@ -1,14 +0,0 @@
-import createQueues from './createQueues-14-vSICK.mjs';
-
-const createQueueContext = (env, specs) => {
-  const bindings = {};
-  for (const spec of specs) {
-    const binding = env[spec.binding];
-    if (binding && typeof binding.send === "function" && typeof binding.sendBatch === "function") {
-      bindings[spec.exportName] = binding;
-    }
-  }
-  return createQueues({ bindings });
-};
-
-export { createQueueContext };