@lunora/runtime 0.0.0 → 1.0.0-alpha.1

package/dist/packem_shared/composeWorker-BYHiNH_V.mjs

@@ -0,0 +1,2489 @@
+import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
+import { emitRpcEvent } from './emitRpcEvent-pEdtqAK8.mjs';
+import { resolveShard } from './resolveShard-DDkzWtrU.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
+
+const AUTH_BASE = "/_lunora/admin/auth";
+const AUTH_ADMIN_ERROR_STATUS = {
+  PASSWORD_TOO_LONG: 400,
+  PASSWORD_TOO_SHORT: 400,
+  USER_ALREADY_EXISTS: 409,
+  USER_NOT_FOUND: 404
+};
+const requireBodyString = (body, field) => {
+  const value = body[field];
+  if (typeof value !== "string" || value === "") {
+    throw new LunoraError(`\`${field}\` is required`, { code: "BAD_REQUEST", status: 400 });
+  }
+  return value;
+};
+const requireQuery$1 = (query, name) => {
+  const value = query(name);
+  if (value === void 0) {
+    throw new LunoraError(`\`${name}\` query parameter is required`, { code: "BAD_REQUEST", status: 400 });
+  }
+  return value;
+};
+const parseRoleInput = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value) && value.every((entry) => typeof entry === "string")) {
+    return value;
+  }
+  return void 0;
+};
+const optionalBodyString = (body, field) => typeof body[field] === "string" ? body[field] : void 0;
+const AUTH_ROUTES = {
+  [`${AUTH_BASE}/capabilities`]: {
+    build: () => {
+      return {};
+    },
+    http: "GET",
+    method: "capabilities"
+  },
+  [`${AUTH_BASE}/users`]: {
+    build: ({ paging, query }) => {
+      const direction = query("sortDirection");
+      return {
+        ...paging,
+        filterField: query("filterField"),
+        filterValue: query("filterValue"),
+        search: query("search"),
+        searchField: query("searchField"),
+        sortBy: query("sortBy"),
+        sortDirection: direction === "asc" || direction === "desc" ? direction : void 0
+      };
+    },
+    http: "GET",
+    method: "listUsers"
+  },
+  [`${AUTH_BASE}/sessions`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, userId: query("userId") };
+    },
+    http: "GET",
+    method: "listSessions"
+  },
+  [`${AUTH_BASE}/accounts`]: {
+    build: ({ query }) => {
+      return { userId: requireQuery$1(query, "userId") };
+    },
+    http: "GET",
+    method: "listAccounts"
+  },
+  [`${AUTH_BASE}/passkeys`]: {
+    build: ({ query }) => {
+      return { userId: requireQuery$1(query, "userId") };
+    },
+    http: "GET",
+    method: "listPasskeys"
+  },
+  [`${AUTH_BASE}/organizations`]: {
+    build: ({ paging }) => {
+      return { ...paging };
+    },
+    http: "GET",
+    method: "listOrganizations"
+  },
+  [`${AUTH_BASE}/organizations/members`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listMembers"
+  },
+  [`${AUTH_BASE}/organizations/invitations`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listInvitations"
+  },
+  // --- mutations (POST) -------------------------------------------------------
+  [`${AUTH_BASE}/users/create`]: {
+    build: ({ body }) => {
+      return {
+        data: typeof body["data"] === "object" && body["data"] !== null && !Array.isArray(body["data"]) ? body["data"] : void 0,
+        email: requireBodyString(body, "email"),
+        name: requireBodyString(body, "name"),
+        password: optionalBodyString(body, "password"),
+        role: parseRoleInput(body["role"])
+      };
+    },
+    http: "POST",
+    method: "createUser"
+  },
+  [`${AUTH_BASE}/users/update`]: {
+    build: ({ body }) => {
+      const { data } = body;
+      if (typeof data !== "object" || data === null || Array.isArray(data)) {
+        throw new LunoraError("`data` object is required", { code: "BAD_REQUEST", status: 400 });
+      }
+      return { data, userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "updateUser"
+  },
+  [`${AUTH_BASE}/users/role`]: {
+    build: ({ body }) => {
+      const role = parseRoleInput(body["role"]);
+      if (role === void 0 || typeof role === "string" && role.trim() === "") {
+        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
+      }
+      return { role, userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "setRole"
+  },
+  [`${AUTH_BASE}/users/ban`]: {
+    build: ({ body }) => {
+      return {
+        expiresInSeconds: typeof body["expiresInSeconds"] === "number" ? body["expiresInSeconds"] : void 0,
+        reason: optionalBodyString(body, "reason"),
+        userId: requireBodyString(body, "userId")
+      };
+    },
+    http: "POST",
+    method: "banUser"
+  },
+  [`${AUTH_BASE}/users/unban`]: {
+    build: ({ body }) => {
+      return { userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "unbanUser"
+  },
+  [`${AUTH_BASE}/users/password`]: {
+    build: ({ body }) => {
+      return { newPassword: requireBodyString(body, "newPassword"), userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "setUserPassword",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/users/remove`]: {
+    build: ({ body }) => {
+      return { userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "removeUser",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/users/impersonate`]: {
+    build: ({ body }) => {
+      return { userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "impersonateUser"
+  },
+  [`${AUTH_BASE}/sessions/revoke`]: {
+    build: ({ body }) => {
+      return { sessionId: requireBodyString(body, "sessionId") };
+    },
+    http: "POST",
+    method: "revokeUserSession",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/sessions/revoke-all`]: {
+    build: ({ body }) => {
+      return { userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "revokeUserSessions",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/accounts/unlink`]: {
+    build: ({ body }) => {
+      return { accountId: requireBodyString(body, "accountId"), userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "unlinkAccount",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/two-factor/disable`]: {
+    build: ({ body }) => {
+      return { userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "disableTwoFactor",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/passkeys/delete`]: {
+    build: ({ body }) => {
+      return { passkeyId: requireBodyString(body, "passkeyId") };
+    },
+    http: "POST",
+    method: "deletePasskey",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/members/remove`]: {
+    build: ({ body }) => {
+      return { memberId: requireBodyString(body, "memberId") };
+    },
+    http: "POST",
+    method: "removeMember",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/invitations/cancel`]: {
+    build: ({ body }) => {
+      return { invitationId: requireBodyString(body, "invitationId") };
+    },
+    http: "POST",
+    method: "cancelInvitation",
+    returns: "void"
+  }
+};
+const buildAuthAdminRoutes = (deps) => {
+  const runAuthOp = async (op) => {
+    try {
+      return await op();
+    } catch (error) {
+      if (error instanceof LunoraError) {
+        throw error;
+      }
+      const candidate = error;
+      const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
+      const message = typeof candidate.message === "string" ? candidate.message : "auth admin operation failed";
+      throw new LunoraError(message, { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+    }
+  };
+  const handle = async (request, descriptor) => {
+    if (request.method !== descriptor.http) {
+      throw new LunoraError(`Auth admin endpoint requires ${descriptor.http}`, { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    deps.assertAdmin(request);
+    const admin = deps.getAuthAdmin();
+    if (admin === void 0) {
+      throw new LunoraError("auth endpoints require an `authAdmin` on the worker", { code: "AUTH_NOT_CONFIGURED", status: 400 });
+    }
+    const method = admin[descriptor.method];
+    if (method === void 0) {
+      throw new LunoraError(`auth admin does not support \`${descriptor.method}\``, { code: "AUTH_OP_NOT_SUPPORTED", status: 400 });
+    }
+    const url = new URL(request.url);
+    const context = {
+      body: descriptor.http === "POST" ? await deps.readJsonBody(request) : {},
+      paging: deps.parsePaging(request),
+      query: (name) => deps.queryParameter(url, name)
+    };
+    const input = descriptor.build(context);
+    const result = await runAuthOp(() => method(input));
+    return Response.json(descriptor.returns === "void" ? { ok: true } : result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const routes = {};
+  for (const [path, descriptor] of Object.entries(AUTH_ROUTES)) {
+    routes[path] = (request) => handle(request, descriptor);
+  }
+  return routes;
+};
+
+const MAX_BODY_BYTES = 1048576;
+const readBodyTextWithLimit = async (request, limit = MAX_BODY_BYTES) => {
+  if (!request.body) {
+    return "";
+  }
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let total = 0;
+  let text = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (value) {
+      total += value.byteLength;
+      if (total > limit) {
+        await reader.cancel().catch(() => {
+        });
+        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  }
+  text += decoder.decode();
+  return text;
+};
+const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
+  if (!request.body) {
+    return new ArrayBuffer(0);
+  }
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (value) {
+      total += value.byteLength;
+      if (total > limit) {
+        await reader.cancel().catch(() => {
+        });
+        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
+      }
+      chunks.push(value);
+    }
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out.buffer;
+};
+const readJsonBodyWithLimit = async (request) => {
+  try {
+    const text = await readBodyTextWithLimit(request);
+    return text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Request body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+};
+
+const CURSOR_ENCODER = new TextEncoder();
+const encodeConnectorCursor = (state) => {
+  const json = JSON.stringify(state);
+  const bytes = CURSOR_ENCODER.encode(json);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCodePoint(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const decodeConnectorCursor = (token) => {
+  const empty = { g: 0, s: {}, v: 1 };
+  if (typeof token !== "string" || token.length === 0) {
+    return empty;
+  }
+  try {
+    const binary = atob(token.replaceAll("-", "+").replaceAll("_", "/"));
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+      bytes[index] = binary.codePointAt(index) ?? 0;
+    }
+    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    const shards = parsed.s && typeof parsed.s === "object" ? parsed.s : {};
+    const sanitized = {};
+    for (const [key, value] of Object.entries(shards)) {
+      if (typeof value === "number" && Number.isFinite(value)) {
+        sanitized[key] = value;
+      }
+    }
+    return { g: typeof parsed.g === "number" && Number.isFinite(parsed.g) ? parsed.g : 0, s: sanitized, v: 1 };
+  } catch {
+    return empty;
+  }
+};
+const flattenCdcChange = (change) => {
+  const table = typeof change["table"] === "string" ? change["table"] : "";
+  const rawOp = typeof change["op"] === "string" ? change["op"] : "";
+  const op = rawOp === "delete" || rawOp === "insert" || rawOp === "update" ? rawOp : "upsert";
+  const id = typeof change["id"] === "string" ? change["id"] : void 0;
+  const postImage = change["doc"] && typeof change["doc"] === "object" ? change["doc"] : void 0;
+  const documentRow = postImage ?? (id === void 0 ? {} : { _id: id });
+  return { doc: documentRow, op, table };
+};
+const foldCdcPage = (changes, pageChanges, limit) => {
+  for (const change of pageChanges) {
+    changes.push(flattenCdcChange(change));
+  }
+  return limit !== void 0 && pageChanges.length >= limit;
+};
+
+const EXPORT_PATH = "/_lunora/admin/export";
+const IMPORT_PATH = "/_lunora/admin/import";
+const SYNC_PATH = "/_lunora/admin/sync";
+const CONNECTOR_SYNC_PATH = "/_lunora/admin/connector/sync";
+const APPLY_PATH = "/_lunora/admin/apply";
+const NDJSON_ENCODER$1 = new TextEncoder();
+const parseExportBody = async (request) => {
+  let body;
+  try {
+    const text = await readBodyTextWithLimit(request);
+    body = text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Export body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  const candidate = body ?? {};
+  if (candidate.tables === void 0) {
+    return { tables: void 0 };
+  }
+  if (!Array.isArray(candidate.tables)) {
+    throw new LunoraError("Export `tables` must be a string array", { code: "BAD_REQUEST", status: 400 });
+  }
+  const tables = [];
+  for (const entry of candidate.tables) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      throw new LunoraError("Export `tables` entries must be non-empty strings", { code: "BAD_REQUEST", status: 400 });
+    }
+    tables.push(entry);
+  }
+  return { tables };
+};
+const buildDataMovementAdminRoutes = (deps) => {
+  const { applyGlobals, isAdmin, knownTables, queryCoordinator, resolveForwardContext, shardDO, streamExportRows, streamingImport, syncGlobals } = deps;
+  const handleExport = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Export endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin export endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const coordinator = queryCoordinator;
+    if (!coordinator) {
+      throw new LunoraError("Export endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const body = await parseExportBody(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const stream = new ReadableStream({
+      async pull(controller) {
+        const writeRow = (row) => {
+          controller.enqueue(NDJSON_ENCODER$1.encode(`${JSON.stringify(row)}
+`));
+        };
+        try {
+          await streamExportRows(coordinator, forwardedHeaders, body.tables, writeRow);
+          controller.close();
+        } catch (error) {
+          controller.error(error);
+        }
+      }
+    });
+    return new Response(stream, { headers: { "content-type": "application/x-ndjson" }, status: 200 });
+  };
+  const handleCdcSync = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const coordinator = queryCoordinator;
+    if (!coordinator) {
+      throw new LunoraError("Sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const raw = await readJsonBodyWithLimit(request);
+    const cursors = typeof raw["cursors"] === "object" && raw["cursors"] !== null ? raw["cursors"] : {};
+    const limit = typeof raw["limit"] === "number" ? raw["limit"] : void 0;
+    const globalCursor = typeof raw["globalCursor"] === "number" ? raw["globalCursor"] : 0;
+    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const probeTables = requestedTables ?? knownTables();
+    const shardResult = await coordinator.orchestrateCdcSync(shardDO, {
+      cursors,
+      headers: forwardedHeaders,
+      limit,
+      tables: probeTables
+    });
+    const global = syncGlobals ? await syncGlobals({ limit, sinceSeq: globalCursor }) : void 0;
+    return Response.json({ global, shards: shardResult.shards }, { status: 200 });
+  };
+  const handleConnectorSync = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Connector sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin connector sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const coordinator = queryCoordinator;
+    if (!coordinator) {
+      throw new LunoraError("Connector sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const raw = await readJsonBodyWithLimit(request);
+    const state = decodeConnectorCursor(raw["cursor"]);
+    const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
+    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const probeTables = requestedTables ?? knownTables();
+    const shardResult = await coordinator.orchestrateCdcSync(shardDO, {
+      cursors: state.s,
+      headers: forwardedHeaders,
+      limit,
+      tables: probeTables
+    });
+    const changes = [];
+    const nextShardCursors = { ...state.s };
+    let hasMore = false;
+    for (const shard of shardResult.shards) {
+      hasMore = foldCdcPage(changes, shard.changes ?? [], limit) || hasMore;
+      nextShardCursors[shard.shardKey] = shard.cursor;
+    }
+    let nextGlobalCursor = state.g;
+    if (syncGlobals) {
+      const global = await syncGlobals({ limit, sinceSeq: state.g });
+      hasMore = foldCdcPage(changes, global.changes, limit) || hasMore;
+      nextGlobalCursor = global.cursor;
+    }
+    const nextCursor = encodeConnectorCursor({ g: nextGlobalCursor, s: nextShardCursors, v: 1 });
+    const page = { changes, hasMore, nextCursor };
+    return Response.json(page, { status: 200 });
+  };
+  const handleApplyCdc = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Apply endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin apply endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const coordinator = queryCoordinator;
+    if (!coordinator) {
+      throw new LunoraError("Apply endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const raw = await readJsonBodyWithLimit(request);
+    const rawBatches = Array.isArray(raw["batches"]) ? raw["batches"] : [];
+    const batches = rawBatches.map((batch) => batch).filter(
+      (batch) => (
+        // Guard object-ness before property access — a `null`/non-object
+        // entry (e.g. `{"batches":[null]}`) would otherwise throw a
+        // TypeError that surfaces as a confusing 500; here it's skipped.
+        batch !== null && typeof batch === "object" && typeof batch.shardKey === "string" && Array.isArray(batch.changes)
+      )
+    );
+    const globalChanges = Array.isArray(raw["globalChanges"]) ? raw["globalChanges"] : [];
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const shardResult = await coordinator.orchestrateApplyCdc(shardDO, { batches, headers: forwardedHeaders });
+    const globalApplied = globalChanges.length > 0 && applyGlobals ? await applyGlobals({ changes: globalChanges }) : 0;
+    return Response.json({ applied: shardResult.applied + globalApplied, failed: shardResult.failed, ok: shardResult.ok }, { status: 200 });
+  };
+  const handleImport = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Import endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin import endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    if (!queryCoordinator) {
+      throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const result = await streamingImport(request, forwardedHeaders);
+    return Response.json(result, {
+      headers: { "content-type": "application/json" },
+      status: 200
+    });
+  };
+  return {
+    [APPLY_PATH]: handleApplyCdc,
+    [CONNECTOR_SYNC_PATH]: handleConnectorSync,
+    [EXPORT_PATH]: handleExport,
+    [IMPORT_PATH]: handleImport,
+    [SYNC_PATH]: handleCdcSync
+  };
+};
+
+const collectKnownTables = (_resolver) => [];
+const partitionExportTables = (options, tables) => {
+  const shardLocalTables = [];
+  const globalTables = [];
+  if (tables && tables.length > 0) {
+    for (const table of tables) {
+      const info = options.resolveTableSharding?.(table);
+      if (info?.mode.kind === "global") {
+        globalTables.push(table);
+      } else {
+        shardLocalTables.push(table);
+      }
+    }
+  }
+  return { globalTables, shardLocalTables };
+};
+const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow) => {
+  if (tables !== void 0 && shardLocalTables.length === 0) {
+    return;
+  }
+  const exportTables = tables === void 0 ? [] : shardLocalTables;
+  const probeFallback = tables === void 0 ? collectKnownTables() : [];
+  const probeTables = exportTables.length > 0 ? exportTables : probeFallback;
+  const result = await coordinator.orchestrateExport(options.shardDO, {
+    args: { tables: exportTables },
+    headers: forwardedHeaders,
+    tables: probeTables
+  });
+  for (const shard of result.shards) {
+    if (shard.error) {
+      continue;
+    }
+    for (const row of shard.rows ?? []) {
+      writeRow(row);
+    }
+  }
+};
+const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow) => {
+  const { globalTables, shardLocalTables } = partitionExportTables(options, tables);
+  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow);
+  const exportGlobalsFunction = options.exportGlobals;
+  const wantGlobals = tables === void 0 || globalTables.length > 0;
+  if (wantGlobals && exportGlobalsFunction) {
+    const tablesArgument = tables === void 0 ? [] : globalTables;
+    for await (const row of exportGlobalsFunction({ tables: tablesArgument })) {
+      writeRow(row);
+    }
+  }
+};
+
+const parseImportRow = (trimmed, lineNumber) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return { error: { code: "BAD_ROW", line: lineNumber, message: "line is not valid JSON", table: "" }, ok: false };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { error: { code: "BAD_ROW", line: lineNumber, message: "row must be a JSON object", table: "" }, ok: false };
+  }
+  const candidate = parsed;
+  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
+    return { error: { code: "BAD_ROW", line: lineNumber, message: "row is missing `table`", table: "" }, ok: false };
+  }
+  if (!candidate.doc || typeof candidate.doc !== "object" || Array.isArray(candidate.doc)) {
+    return { error: { code: "BAD_ROW", line: lineNumber, message: "row is missing or malformed `doc`", table: candidate.table }, ok: false };
+  }
+  return { doc: candidate.doc, ok: true, table: candidate.table };
+};
+const resolveImportShardKey = (documentRow, table, info, defaultShard, lineNumber) => {
+  if (info?.mode.kind === "shardBy" && typeof info.mode.field === "string") {
+    const raw = documentRow[info.mode.field];
+    if (raw === void 0 || raw === null) {
+      return {
+        error: { code: "BAD_ROW", line: lineNumber, message: `row missing shard field "${info.mode.field}" for table "${table}"`, table },
+        ok: false
+      };
+    }
+    return { ok: true, shardKey: typeof raw === "string" ? raw : JSON.stringify(raw) };
+  }
+  return { ok: true, shardKey: defaultShard };
+};
+const bucketImportStream = async (request, options, defaultShard) => {
+  if (!request.body) {
+    throw new LunoraError("Import endpoint requires a request body", { code: "BAD_REQUEST", status: 400 });
+  }
+  const errors = [];
+  const globalRows = [];
+  const perShard = /* @__PURE__ */ new Map();
+  let physicalLine = 0;
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let totalBytes = 0;
+  const handleLine = (line) => {
+    physicalLine += 1;
+    const trimmed = line.trim();
+    if (trimmed.length === 0) {
+      return;
+    }
+    const row = parseImportRow(trimmed, physicalLine);
+    if (!row.ok) {
+      errors.push(row.error);
+      return;
+    }
+    const { doc: documentRow, table } = row;
+    const info = options.resolveTableSharding?.(table);
+    if (info?.mode.kind === "global") {
+      globalRows.push({ doc: documentRow, line: physicalLine, table });
+      return;
+    }
+    const resolved = resolveImportShardKey(documentRow, table, info, defaultShard, physicalLine);
+    if (!resolved.ok) {
+      errors.push(resolved.error);
+      return;
+    }
+    const existing = perShard.get(resolved.shardKey);
+    if (existing) {
+      existing.rows.push({ doc: documentRow, table });
+    } else {
+      perShard.set(resolved.shardKey, { rows: [{ doc: documentRow, table }], shardKey: resolved.shardKey, startLine: physicalLine });
+    }
+  };
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (value) {
+      totalBytes += value.byteLength;
+      if (totalBytes > MAX_BODY_BYTES) {
+        await reader.cancel().catch(() => {
+        });
+        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
+      }
+    }
+    buffer += decoder.decode(value, { stream: true });
+    let newlineIndex = buffer.indexOf("\n");
+    while (newlineIndex !== -1) {
+      const line = buffer.slice(0, newlineIndex);
+      buffer = buffer.slice(newlineIndex + 1);
+      handleLine(line);
+      newlineIndex = buffer.indexOf("\n");
+    }
+  }
+  if (buffer.length > 0) {
+    handleLine(buffer);
+  }
+  return { errors, globalRows, perShard };
+};
+const mergeImportResult = (totals, result) => {
+  for (const [table, count] of Object.entries(result.inserted)) {
+    totals.inserted[table] = (totals.inserted[table] ?? 0) + count;
+  }
+  for (const rowError of result.errors) {
+    totals.errors.push({ ...rowError });
+  }
+  totals.conflicts += result.conflicts;
+};
+const streamingImport = async (request, options, forwardedHeaders) => {
+  const defaultShard = options.defaultShardKey ?? "__root__";
+  const { errors, globalRows, perShard } = await bucketImportStream(request, options, defaultShard);
+  const totals = { conflicts: 0, errors, inserted: {} };
+  if (perShard.size > 0) {
+    const coordinator = options.queryCoordinator;
+    if (!coordinator) {
+      throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const result = await coordinator.orchestrateImport(options.shardDO, {
+      batches: [...perShard.values()],
+      headers: forwardedHeaders
+    });
+    mergeImportResult(totals, result);
+  }
+  if (globalRows.length > 0) {
+    if (options.importGlobals) {
+      const startLine = globalRows[0]?.line ?? 1;
+      const result = await options.importGlobals({ rows: globalRows, startLine });
+      mergeImportResult(totals, result);
+    } else {
+      for (const globalRow of globalRows) {
+        totals.errors.push({
+          code: "GLOBAL_NOT_CONFIGURED",
+          line: globalRow.line,
+          message: `row targets global table "${globalRow.table}" but no \`importGlobals\` is configured`,
+          table: globalRow.table
+        });
+      }
+    }
+  }
+  return { conflicts: totals.conflicts, errors: totals.errors, inserted: totals.inserted };
+};
+
+const asValidator = (value) => typeof value === "object" && value !== null ? value : {};
+const kindOf = (validator) => typeof validator.kind === "string" ? validator.kind : "unknown";
+const describeArgument = (name, validator) => {
+  let current = asValidator(validator);
+  let optional = false;
+  if (kindOf(current) === "optional") {
+    optional = true;
+    current = asValidator(current._meta?.["inner"]);
+  }
+  const kind = kindOf(current);
+  const meta = current._meta ?? {};
+  const descriptor = { kind, name, optional };
+  if (kind === "id" && typeof meta["tableName"] === "string") {
+    descriptor.table = meta["tableName"];
+  }
+  if (kind === "array") {
+    const elementKind = kindOf(asValidator(meta["inner"]));
+    if (elementKind !== "unknown") {
+      descriptor.element = elementKind;
+    }
+  }
+  return descriptor;
+};
+const describeArguments = (args) => {
+  if (typeof args !== "object" || args === null) {
+    return [];
+  }
+  return Object.entries(args).map(([name, validator]) => describeArgument(name, validator)).toSorted((a, b) => a.name.localeCompare(b.name));
+};
+
+const FUNCTIONS_PATH = "/_lunora/admin/functions";
+const CRON_JOBS_PATH = "/_lunora/admin/cron-jobs";
+const OPENAPI_PATH = "/_lunora/admin/openapi";
+const OPENRPC_PATH = "/_lunora/admin/openrpc";
+const GLOBAL_TABLES_PATH = "/_lunora/admin/global/tables";
+const GLOBAL_TABLE_PATH = "/_lunora/admin/global/table";
+const GLOBAL_FACET_PATH = "/_lunora/admin/global/facet";
+const parseGlobalFilters = (raw) => {
+  if (raw === void 0 || raw === "") {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(parsed)) {
+    return void 0;
+  }
+  const clauses = parsed.flatMap((entry) => {
+    if (typeof entry !== "object" || entry === null || typeof entry.column !== "string") {
+      return [];
+    }
+    const { column, value } = entry;
+    return [{ column, value }];
+  });
+  return clauses.length === 0 ? void 0 : clauses;
+};
+const EMPTY_OPENAPI_DOCUMENT = Object.freeze({
+  info: {
+    description: 'No OpenAPI spec is configured on this worker. Run `lunora codegen`, then wire the generated module to `createWorker`: `import { openApiSpec } from "./lunora/_generated/openapi"`.',
+    title: "Lunora API",
+    version: "0.0.0"
+  },
+  openapi: "3.1.0",
+  paths: {}
+});
+const EMPTY_OPENRPC_DOCUMENT = Object.freeze({
+  info: {
+    description: 'No OpenRPC spec is configured on this worker. Run `lunora codegen --api-spec openrpc` (or `both`), then wire the generated module to `createWorker`: `import { openRpcSpec } from "./lunora/_generated/openrpc"`.',
+    title: "Lunora RPC",
+    version: "0.0.0"
+  },
+  methods: [],
+  openrpc: "1.3.2"
+});
+const buildIntrospectionAdminRoutes = (deps) => {
+  const { assertAdmin, options, parsePaging, queryParameter, requireAdminOption } = deps;
+  const handleFunctionsList = (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Functions endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const registry = requireAdminOption(request, options.functions, {
+      code: "FUNCTIONS_NOT_CONFIGURED",
+      message: "functions endpoint requires a `functions` registry on the worker"
+    });
+    const functions = Object.entries(registry).flatMap(([path, entry]) => {
+      if (entry.visibility === "internal" || entry.kind === "stream") {
+        return [];
+      }
+      return [{ args: describeArguments(entry.args), kind: entry.kind, path }];
+    }).toSorted((a, b) => a.path.localeCompare(b.path));
+    return Response.json({ functions }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleCronJobs = (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Cron-jobs endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const registry = requireAdminOption(request, options.cronJobs, {
+      code: "CRON_JOBS_NOT_CONFIGURED",
+      message: "cron-jobs endpoint requires a `cronJobs` map on the worker"
+    });
+    const jobs = Object.entries(registry).flatMap(
+      ([cron, dispatches]) => dispatches.map((dispatch) => {
+        return {
+          args: dispatch.args,
+          cron,
+          functionPath: dispatch.functionPath,
+          name: dispatch.name,
+          shardKey: dispatch.shardKey,
+          workflow: dispatch.workflow
+        };
+      })
+    ).toSorted((a, b) => a.name.localeCompare(b.name));
+    return Response.json({ jobs }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleOpenApi = (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("OpenAPI endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    return Response.json(options.openApiSpec ?? EMPTY_OPENAPI_DOCUMENT, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleOpenRpc = (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("OpenRPC endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    return Response.json(options.openRpcSpec ?? EMPTY_OPENRPC_DOCUMENT, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleGlobalTables = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Global-tables endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = requireAdminOption(request, options.globalIntrospector, {
+      code: "GLOBALS_NOT_CONFIGURED",
+      message: "global endpoints require a `globalIntrospector` on the worker"
+    });
+    return Response.json(await introspector.listTables(), { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleGlobalTablePage = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Global-table endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = requireAdminOption(request, options.globalIntrospector, {
+      code: "GLOBALS_NOT_CONFIGURED",
+      message: "global endpoints require a `globalIntrospector` on the worker"
+    });
+    const url = new URL(request.url);
+    const table = queryParameter(url, "table");
+    if (table === void 0) {
+      throw new LunoraError("Global-table endpoint requires a `table` query param", { code: "BAD_REQUEST", status: 400 });
+    }
+    const page = await introspector.readTablePage({ ...parsePaging(request), filters: parseGlobalFilters(queryParameter(url, "filters")), table });
+    return Response.json(page, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleGlobalFacet = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Global-facet endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = requireAdminOption(request, options.globalIntrospector, {
+      code: "GLOBALS_NOT_CONFIGURED",
+      message: "global endpoints require a `globalIntrospector` on the worker"
+    });
+    const url = new URL(request.url);
+    const table = queryParameter(url, "table");
+    const column = queryParameter(url, "column");
+    if (table === void 0 || column === void 0) {
+      throw new LunoraError("Global-facet endpoint requires `table` and `column` query params", { code: "BAD_REQUEST", status: 400 });
+    }
+    const limitParameter = queryParameter(url, "limit");
+    const limit = limitParameter === void 0 ? void 0 : Number(limitParameter);
+    const result = await introspector.facetColumn({
+      column,
+      filters: parseGlobalFilters(queryParameter(url, "filters")),
+      limit: limit !== void 0 && Number.isFinite(limit) ? limit : void 0,
+      table
+    });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  return {
+    [CRON_JOBS_PATH]: handleCronJobs,
+    [FUNCTIONS_PATH]: handleFunctionsList,
+    [GLOBAL_FACET_PATH]: handleGlobalFacet,
+    [GLOBAL_TABLE_PATH]: handleGlobalTablePage,
+    [GLOBAL_TABLES_PATH]: handleGlobalTables,
+    [OPENAPI_PATH]: handleOpenApi,
+    [OPENRPC_PATH]: handleOpenRpc
+  };
+};
+
+const MIGRATE_PATH = "/_lunora/migrate";
+const PITR_PATH = "/_lunora/admin/pitr";
+const RANK_PATH = "/_lunora/admin/rank";
+const RANKPAGE_PATH = "/_lunora/admin/rankpage";
+const SHARD_TRAFFIC_PATH = "/_lunora/admin/shard-traffic";
+const MIGRATION_ADMIN_OPS = /* @__PURE__ */ new Set(["__lunora_admin__:migrationStatus", "__lunora_admin__:runMigration"]);
+const PITR_ADMIN_OPS = /* @__PURE__ */ new Set(["__lunora_admin__:getPitrBookmark", "__lunora_admin__:pitrRestore"]);
+const parseMigrateRequest = async (request) => {
+  let body;
+  try {
+    const text = await readBodyTextWithLimit(request);
+    body = text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Migration body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  const candidate = body ?? {};
+  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
+    throw new LunoraError("Migration request is missing `table`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (typeof candidate.functionPath !== "string" || !MIGRATION_ADMIN_OPS.has(candidate.functionPath)) {
+    throw new LunoraError("Migration request `functionPath` must be a migration admin op", { code: "BAD_REQUEST", status: 400 });
+  }
+  return {
+    args: candidate.args ?? {},
+    functionPath: candidate.functionPath,
+    table: candidate.table
+  };
+};
+const parseRankRequest = async (request) => {
+  let body;
+  try {
+    const text = await readBodyTextWithLimit(request);
+    body = text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Rank body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  const candidate = body ?? {};
+  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
+    throw new LunoraError("Rank request is missing `table`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (typeof candidate.index !== "string" || candidate.index.length === 0) {
+    throw new LunoraError("Rank request is missing `index`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (typeof candidate.partitionKey !== "string") {
+    throw new LunoraError("Rank request `partitionKey` must be a string", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (typeof candidate.rowId !== "string" || candidate.rowId.length === 0) {
+    throw new LunoraError("Rank request is missing `rowId`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (!Array.isArray(candidate.sortValues)) {
+    throw new LunoraError("Rank request `sortValues` must be an array", { code: "BAD_REQUEST", status: 400 });
+  }
+  return {
+    index: candidate.index,
+    partitionKey: candidate.partitionKey,
+    rowId: candidate.rowId,
+    sortValues: candidate.sortValues,
+    table: candidate.table
+  };
+};
+const parseRankPageDirections = (raw) => {
+  if (raw === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(raw) || raw.some((d) => d !== "asc" && d !== "desc")) {
+    throw new LunoraError('Rank page request `directions` must be an array of "asc"|"desc"', { code: "BAD_REQUEST", status: 400 });
+  }
+  return raw;
+};
+const validateRankPageScalars = (candidate) => {
+  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
+    throw new LunoraError("Rank page request is missing `table`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (typeof candidate.index !== "string" || candidate.index.length === 0) {
+    throw new LunoraError("Rank page request is missing `index`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (candidate.partitionKey !== void 0 && typeof candidate.partitionKey !== "string") {
+    throw new LunoraError("Rank page request `partitionKey` must be a string", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (candidate.take !== void 0 && (typeof candidate.take !== "number" || !Number.isFinite(candidate.take))) {
+    throw new LunoraError("Rank page request `take` must be a number", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (candidate.cursor !== void 0 && candidate.cursor !== null && typeof candidate.cursor !== "string") {
+    throw new LunoraError("Rank page request `cursor` must be a string or null", { code: "BAD_REQUEST", status: 400 });
+  }
+};
+const parseRankPageRequest = async (request) => {
+  let body;
+  try {
+    const text = await readBodyTextWithLimit(request);
+    body = text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Rank page body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  const candidate = body ?? {};
+  validateRankPageScalars(candidate);
+  const directions = parseRankPageDirections(candidate.directions);
+  return {
+    // eslint-disable-next-line unicorn/no-null -- the wire cursor is `null | string`; normalize an absent cursor to null so the coordinator starts at the first page
+    cursor: typeof candidate.cursor === "string" ? candidate.cursor : null,
+    directions,
+    index: candidate.index,
+    partitionKey: typeof candidate.partitionKey === "string" ? candidate.partitionKey : void 0,
+    table: candidate.table,
+    take: typeof candidate.take === "number" ? candidate.take : void 0
+  };
+};
+const parseShardTrafficRequest = async (request) => {
+  let body;
+  try {
+    const text = await readBodyTextWithLimit(request);
+    body = text === "" ? {} : JSON.parse(text);
+  } catch (error) {
+    if (error instanceof LunoraError) {
+      throw error;
+    }
+    throw new LunoraError("Shard-traffic body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  const candidate = body ?? {};
+  if (typeof candidate.table !== "string" || candidate.table.length === 0) {
+    throw new LunoraError("Shard-traffic request is missing `table`", { code: "BAD_REQUEST", status: 400 });
+  }
+  return { table: candidate.table };
+};
+const parsePitrRequest = async (request) => {
+  const body = await readJsonBodyWithLimit(request);
+  const candidate = body;
+  if (typeof candidate.functionPath !== "string" || !PITR_ADMIN_OPS.has(candidate.functionPath)) {
+    throw new LunoraError("PITR request `functionPath` must be a PITR admin op", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (candidate.shardKey !== void 0 && typeof candidate.shardKey !== "string") {
+    throw new LunoraError("PITR `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
+  }
+  return {
+    args: candidate.args ?? {},
+    functionPath: candidate.functionPath,
+    shardKey: candidate.shardKey
+  };
+};
+const buildOrchestrationAdminRoutes = (deps) => {
+  const { defaultShard, forwardToShard, isAdmin, queryCoordinator, resolveForwardContext, shardDO } = deps;
+  const handleMigrate = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Migration endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
+    }
+    if (!queryCoordinator) {
+      throw new LunoraError("Migration endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const migrate = await parseMigrateRequest(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const result = await queryCoordinator.orchestrateMigration(shardDO, {
+      args: migrate.args,
+      functionPath: migrate.functionPath,
+      headers: forwardedHeaders,
+      table: migrate.table
+    });
+    return Response.json(result, {
+      headers: { "content-type": "application/json" },
+      status: 200
+    });
+  };
+  const handleRank = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Rank endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
+    }
+    if (!queryCoordinator) {
+      throw new LunoraError("Rank endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const rank = await parseRankRequest(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const result = await queryCoordinator.orchestrateRank(shardDO, {
+      headers: forwardedHeaders,
+      index: rank.index,
+      partitionKey: rank.partitionKey,
+      rowId: rank.rowId,
+      sortValues: rank.sortValues,
+      table: rank.table
+    });
+    return Response.json(result, {
+      headers: { "content-type": "application/json" },
+      status: 200
+    });
+  };
+  const handleRankPage = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Rank page endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
+    }
+    if (!queryCoordinator) {
+      throw new LunoraError("Rank page endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const rankPage = await parseRankPageRequest(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const result = await queryCoordinator.orchestrateRankPage(shardDO, {
+      ...rankPage,
+      headers: forwardedHeaders
+    });
+    return Response.json(result, {
+      headers: { "content-type": "application/json" },
+      status: 200
+    });
+  };
+  const handleShardTraffic = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Shard-traffic endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("Admin auth required", { code: "FORBIDDEN", status: 403 });
+    }
+    if (!queryCoordinator) {
+      throw new LunoraError("Shard-traffic endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    }
+    const trafficRequest = await parseShardTrafficRequest(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const result = await queryCoordinator.orchestrateShardTraffic(shardDO, {
+      headers: forwardedHeaders,
+      table: trafficRequest.table
+    });
+    return Response.json(result, {
+      headers: { "content-type": "application/json" },
+      status: 200
+    });
+  };
+  const handlePitr = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("PITR endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!isAdmin(request)) {
+      throw new LunoraError("admin PITR endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const pitr = await parsePitrRequest(request);
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const forwarded = new Request("https://shard.internal/rpc", {
+      body: JSON.stringify({ args: pitr.args, functionPath: pitr.functionPath }),
+      headers: forwardedHeaders,
+      method: "POST"
+    });
+    return forwardToShard(shardDO, pitr.shardKey ?? defaultShard, forwarded);
+  };
+  return {
+    [MIGRATE_PATH]: handleMigrate,
+    [PITR_PATH]: handlePitr,
+    [RANK_PATH]: handleRank,
+    [RANKPAGE_PATH]: handleRankPage,
+    [SHARD_TRAFFIC_PATH]: handleShardTraffic
+  };
+};
+
+const SCHEDULED_PATH = "/_lunora/admin/scheduled";
+const SCHEDULED_STATUS_PATH = "/_lunora/admin/scheduled/status";
+const SCHEDULED_WS_PATH = "/_lunora/admin/scheduled/ws";
+const SCHEDULED_CANCEL_PATH = "/_lunora/admin/scheduled/cancel";
+const SCHEDULED_DEAD_PATH = "/_lunora/admin/scheduled/dead";
+const SCHEDULED_DEAD_RETRY_PATH = "/_lunora/admin/scheduled/dead/retry";
+const SCHEDULED_DEAD_CANCEL_PATH = "/_lunora/admin/scheduled/dead/cancel";
+const buildScheduledAdminRoutes = (deps) => {
+  const { checkWsAdmin, requireSchedulerNamespace, resolveSchedulerStub, schedulerInstanceName } = deps;
+  const handleScheduledList = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Scheduled-list endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const stub = resolveSchedulerStub(request);
+    return stub.fetch(new Request("https://scheduler.internal/list", { method: "GET" }));
+  };
+  const handleSchedulerStatus = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Scheduler-status endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const stub = resolveSchedulerStub(request);
+    return stub.fetch(new Request("https://scheduler.internal/status", { method: "GET" }));
+  };
+  const handleScheduledWebSocket = (request) => {
+    if (request.headers.get("Upgrade") !== "websocket") {
+      throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
+    }
+    if (!checkWsAdmin(request)) {
+      throw new LunoraError("admin authorization required", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    const namespace = requireSchedulerNamespace();
+    const stub = resolveShard(namespace, schedulerInstanceName);
+    return stub.fetch(new Request("https://scheduler.internal/ws", { headers: { Upgrade: "websocket" } }));
+  };
+  const handleScheduledCancel = async (request) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Scheduled-cancel endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const stub = resolveSchedulerStub(request);
+    const body = await request.json().catch(() => void 0);
+    if (typeof body?.id !== "string" || body.id === "") {
+      throw new LunoraError("Scheduled-cancel requires a string `id`", { code: "BAD_REQUEST", status: 400 });
+    }
+    return stub.fetch(
+      new Request("https://scheduler.internal/cancel", {
+        body: JSON.stringify({ id: body.id }),
+        headers: { "content-type": "application/json" },
+        method: "POST"
+      })
+    );
+  };
+  const handleDeadList = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Scheduled dead-letter endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const stub = resolveSchedulerStub(request);
+    return stub.fetch(new Request("https://scheduler.internal/dead", { method: "GET" }));
+  };
+  const proxyDeadAction = (doPath) => async (request) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Scheduled dead-letter action requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const stub = resolveSchedulerStub(request);
+    const body = await request.json().catch(() => void 0);
+    if (typeof body?.id !== "string" || body.id === "") {
+      throw new LunoraError("Scheduled dead-letter action requires a string `id`", { code: "BAD_REQUEST", status: 400 });
+    }
+    return stub.fetch(
+      new Request(`https://scheduler.internal${doPath}`, {
+        body: JSON.stringify({ id: body.id }),
+        headers: { "content-type": "application/json" },
+        method: "POST"
+      })
+    );
+  };
+  return {
+    [SCHEDULED_CANCEL_PATH]: handleScheduledCancel,
+    [SCHEDULED_DEAD_CANCEL_PATH]: proxyDeadAction("/dead/cancel"),
+    [SCHEDULED_DEAD_PATH]: handleDeadList,
+    [SCHEDULED_DEAD_RETRY_PATH]: proxyDeadAction("/dead/retry"),
+    [SCHEDULED_PATH]: handleScheduledList,
+    [SCHEDULED_STATUS_PATH]: handleSchedulerStatus,
+    [SCHEDULED_WS_PATH]: handleScheduledWebSocket
+  };
+};
+
+const STORAGE_PATH = "/_lunora/admin/storage";
+const STORAGE_URL_PATH = "/_lunora/admin/storage/url";
+const STORAGE_BUCKETS_PATH = "/_lunora/admin/storage/buckets";
+const MAX_STORAGE_EXPIRES_IN_SECONDS = 7 * 24 * 60 * 60;
+const buildStorageAdminRoutes = (deps) => {
+  const { assertAdmin, parsePaging, queryParameter, readBodyBytes, requireAdminOption, storage } = deps;
+  const requireStorageKey = (url) => {
+    const key = queryParameter(url, "key");
+    if (key === void 0) {
+      throw new LunoraError("Storage endpoint requires a `key` query parameter", { code: "BAD_REQUEST", status: 400 });
+    }
+    return key;
+  };
+  const handleStorageList = async (request) => {
+    const storageList = requireAdminOption(request, storage.storageList, {
+      code: "STORAGE_NOT_CONFIGURED",
+      message: "storage endpoint requires a `storageList` function on the worker"
+    });
+    const url = new URL(request.url);
+    const result = await storageList(queryParameter(url, "prefix"), {
+      bucket: queryParameter(url, "bucket"),
+      cursor: queryParameter(url, "cursor"),
+      ...parsePaging(request)
+    });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleStorageBuckets = (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Storage-buckets endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    return Response.json({ buckets: storage.storageBuckets ?? [] }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleStorageDelete = async (request) => {
+    const storageDelete = requireAdminOption(request, storage.storageDelete, {
+      code: "STORAGE_DELETE_NOT_CONFIGURED",
+      message: "storage delete requires a `storageDelete` function on the worker"
+    });
+    const url = new URL(request.url);
+    const key = requireStorageKey(url);
+    await storageDelete(key, { bucket: queryParameter(url, "bucket") });
+    return Response.json({ deleted: true, key }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleStorageUpload = async (request) => {
+    const storageUpload = requireAdminOption(request, storage.storageUpload, {
+      code: "STORAGE_UPLOAD_NOT_CONFIGURED",
+      message: "storage upload requires a `storageUpload` function on the worker"
+    });
+    const url = new URL(request.url);
+    const key = requireStorageKey(url);
+    const body = await readBodyBytes(request);
+    const headerContentType = request.headers.get("content-type");
+    const contentType = headerContentType === null || headerContentType === "" ? void 0 : headerContentType;
+    const result = await storageUpload(key, body, { bucket: queryParameter(url, "bucket"), contentType });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleStorage = async (request) => {
+    switch (request.method) {
+      case "DELETE": {
+        return handleStorageDelete(request);
+      }
+      case "GET": {
+        return handleStorageList(request);
+      }
+      case "POST":
+      case "PUT": {
+        return handleStorageUpload(request);
+      }
+      default: {
+        throw new LunoraError("Storage endpoint requires GET, PUT, POST, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
+      }
+    }
+  };
+  const handleStorageSignedUrl = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Storage URL endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const storageSignedUrl = requireAdminOption(request, storage.storageSignedUrl, {
+      code: "STORAGE_URL_NOT_CONFIGURED",
+      message: "storage URL endpoint requires a `storageSignedUrl` function on the worker"
+    });
+    const url = new URL(request.url);
+    const key = requireStorageKey(url);
+    const expiresInRaw = Number(queryParameter(url, "expiresIn") ?? "");
+    const expiresInSeconds = Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? Math.min(expiresInRaw, MAX_STORAGE_EXPIRES_IN_SECONDS) : void 0;
+    const signedUrl = await storageSignedUrl(key, { bucket: queryParameter(url, "bucket"), expiresInSeconds });
+    return Response.json({ key, url: signedUrl }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  return {
+    [STORAGE_BUCKETS_PATH]: handleStorageBuckets,
+    [STORAGE_PATH]: handleStorage,
+    [STORAGE_URL_PATH]: handleStorageSignedUrl
+  };
+};
+
+const VECTOR_INDEXES_PATH = "/_lunora/admin/vector/indexes";
+const VECTOR_QUERY_PATH = "/_lunora/admin/vector/query";
+const buildVectorAdminRoutes = (deps) => {
+  const { readJsonBody, requireAdminOption } = deps;
+  const handleVectorIndexes = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Vector-indexes endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = requireAdminOption(request, deps.vectorIntrospector, {
+      code: "VECTORS_NOT_CONFIGURED",
+      message: "vector endpoints require a `vectorIntrospector` on the worker"
+    });
+    return Response.json({ indexes: await introspector.listIndexes() }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const handleVectorQuery = async (request) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Vector-query endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = requireAdminOption(request, deps.vectorIntrospector, {
+      code: "VECTORS_NOT_CONFIGURED",
+      message: "vector endpoints require a `vectorIntrospector` on the worker"
+    });
+    if (introspector.queryIndex === void 0) {
+      throw new LunoraError("vector index querying is not enabled on this worker", { code: "VECTOR_QUERY_UNSUPPORTED", status: 400 });
+    }
+    const body = await readJsonBody(request);
+    const candidate = body;
+    if (typeof candidate.name !== "string" || candidate.name === "") {
+      throw new LunoraError("Vector-query request requires a `name` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.text !== "string" || candidate.text === "") {
+      throw new LunoraError("Vector-query request requires a `text` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (candidate.topK !== void 0 && (typeof candidate.topK !== "number" || !Number.isInteger(candidate.topK) || candidate.topK < 1)) {
+      throw new LunoraError("Vector-query `topK` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    const result = await introspector.queryIndex({ name: candidate.name, text: candidate.text, topK: candidate.topK });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  return {
+    [VECTOR_INDEXES_PATH]: handleVectorIndexes,
+    [VECTOR_QUERY_PATH]: handleVectorQuery
+  };
+};
+
+const WORKFLOWS_INSTANCES_PATH = "/_lunora/admin/workflows/instances";
+const WORKFLOWS_INSTANCE_PATH = "/_lunora/admin/workflows/instance";
+const WORKFLOWS_STATUS_PATH = "/_lunora/admin/workflows/status";
+const INSTANCE_STATUSES = {
+  complete: true,
+  errored: true,
+  paused: true,
+  queued: true,
+  running: true,
+  terminated: true,
+  unknown: true,
+  waiting: true,
+  waitingForPause: true
+};
+const toInstanceStatus = (value) => value !== null && Object.hasOwn(INSTANCE_STATUSES, value) ? value : void 0;
+const positiveIntParameter = (url, key) => {
+  const raw = url.searchParams.get(key);
+  if (raw === null) {
+    return void 0;
+  }
+  const value = Number(raw);
+  return Number.isInteger(value) && value > 0 ? value : void 0;
+};
+const requireQuery = (url, key) => {
+  const value = url.searchParams.get(key);
+  if (value === null || value === "") {
+    throw new LunoraError(`Workflows admin endpoint requires a \`${key}\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+  }
+  return value;
+};
+const throwNotConfigured = () => {
+  throw new LunoraError("Workflow inspection is unconfigured. Set CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN in your .dev.vars to enable it.", {
+    code: "WORKFLOWS_NOT_CONFIGURED",
+    status: 501
+  });
+};
+const buildWorkflowsAdminRoutes = (deps) => {
+  const { assertAdmin, resolveWorkflowsClient } = deps;
+  const handleInstances = async (request, env, url) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Workflows instances endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    const client = resolveWorkflowsClient(env);
+    if (!client) {
+      return throwNotConfigured();
+    }
+    const workflowName = requireQuery(url, "name");
+    const status = toInstanceStatus(url.searchParams.get("status"));
+    return Response.json(
+      await client.listInstances({
+        page: positiveIntParameter(url, "page"),
+        perPage: positiveIntParameter(url, "perPage"),
+        status,
+        workflowName
+      })
+    );
+  };
+  const handleInstance = async (request, env, url) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("Workflows instance endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    const client = resolveWorkflowsClient(env);
+    if (!client) {
+      return throwNotConfigured();
+    }
+    return Response.json(await client.getInstance({ instanceId: requireQuery(url, "id"), workflowName: requireQuery(url, "name") }));
+  };
+  const handleStatus = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Workflows status endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    assertAdmin(request);
+    const client = resolveWorkflowsClient(env);
+    if (!client) {
+      return throwNotConfigured();
+    }
+    const body = await request.json().catch(() => void 0);
+    if (typeof body?.name !== "string" || body.name === "" || typeof body.id !== "string" || body.id === "") {
+      throw new LunoraError("Workflows status action requires string `name` and `id`", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { action } = body;
+    if (action !== "pause" && action !== "resume" && action !== "terminate") {
+      throw new LunoraError("Workflows status action must be one of: pause, resume, terminate", { code: "BAD_REQUEST", status: 400 });
+    }
+    return Response.json(await client.setInstanceStatus({ action, instanceId: body.id, workflowName: body.name }));
+  };
+  return {
+    [WORKFLOWS_INSTANCE_PATH]: handleInstance,
+    [WORKFLOWS_INSTANCES_PATH]: handleInstances,
+    [WORKFLOWS_STATUS_PATH]: handleStatus
+  };
+};
+
+const NDJSON_ENCODER = new TextEncoder();
+const RPC_PATH = "/_lunora/rpc";
+const WS_PATH = "/_lunora/ws";
+const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
+const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const DEFAULT_AUTH_BASE_PATH = "/api/auth";
+const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
+const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
+const isAuthAttemptPath = (pathname, basePath) => {
+  const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+  if (!pathname.startsWith(`${base}/`)) {
+    return false;
+  }
+  const suffix = pathname.slice(base.length);
+  return AUTH_ATTEMPT_SEGMENTS.some((segment) => suffix === segment || suffix.startsWith(`${segment}/`));
+};
+const buildErrorEvent = (functionPath, durationMs, error, extra) => {
+  const mappable = error instanceof LunoraError || isStructuralLunoraError(error) || isStructuralConflictError(error);
+  const code = mappable ? error.code : "INTERNAL_SERVER_ERROR";
+  const status = mappable ? error.status : 500;
+  const message = error instanceof Error ? error.message : String(error);
+  return {
+    durationMs,
+    error: { code, message, status },
+    functionPath,
+    ok: false,
+    ...extra.fanOut ? { fanOut: { failed: 0, shards: 0, table: extra.fanOut.table } } : {},
+    ...extra.shardKey ? { shardKey: extra.shardKey } : {}
+  };
+};
+const identityExpiryMs = (identity) => {
+  const { exp, expiresAtMs } = identity;
+  if (typeof expiresAtMs === "number" && Number.isFinite(expiresAtMs)) {
+    return expiresAtMs;
+  }
+  if (typeof exp === "number" && Number.isFinite(exp)) {
+    return exp * 1e3;
+  }
+  return void 0;
+};
+const resolveForwardContext = async (request, env, resolveIdentity) => {
+  const headers = { "content-type": "application/json" };
+  const authorization = request.headers.get("authorization");
+  const cookie = request.headers.get("cookie");
+  const bookmark = request.headers.get("x-d1-bookmark");
+  const mutationId = request.headers.get("x-lunora-mutation-id");
+  if (authorization) {
+    headers["authorization"] = authorization;
+  }
+  if (cookie) {
+    headers["cookie"] = cookie;
+  }
+  if (bookmark) {
+    headers["x-d1-bookmark"] = bookmark;
+  }
+  if (mutationId) {
+    headers["x-lunora-mutation-id"] = mutationId;
+  }
+  const clientIp = request.headers.get("cf-connecting-ip");
+  if (clientIp) {
+    headers["x-lunora-client-ip"] = clientIp;
+  }
+  if (!resolveIdentity) {
+    return { claims: null, headers, identity: null, userId: null };
+  }
+  const identity = await resolveIdentity(request, env);
+  if (!identity || typeof identity.userId !== "string" || identity.userId.length === 0) {
+    return { claims: null, headers, identity: null, userId: null };
+  }
+  headers["x-lunora-userid"] = identity.userId;
+  const expiresAtMs = identityExpiryMs(identity);
+  if (expiresAtMs !== void 0) {
+    headers["x-lunora-identity-exp"] = String(expiresAtMs);
+  }
+  const { userId, ...extra } = identity;
+  const claims = Object.keys(extra).length > 0 ? extra : null;
+  if (claims) {
+    headers["x-lunora-identity"] = JSON.stringify(claims);
+  }
+  return { claims, headers, identity, userId };
+};
+const KNOWN_MERGE_KINDS = /* @__PURE__ */ new Set(["concat", "first", "groupBy", "max", "min", "rank", "sum", "topK"]);
+const validateFanOut = (fanOut) => {
+  if (fanOut === void 0) {
+    return void 0;
+  }
+  if (!fanOut || typeof fanOut !== "object") {
+    throw new LunoraError("RPC `fanOut` must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  const spec = fanOut;
+  if (typeof spec.table !== "string" || spec.table.length === 0) {
+    throw new LunoraError("RPC `fanOut.table` must be a non-empty string", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (!spec.merge || typeof spec.merge !== "object") {
+    throw new LunoraError("RPC `fanOut.merge` must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  const merge = spec.merge;
+  if (typeof merge.kind !== "string" || !KNOWN_MERGE_KINDS.has(merge.kind)) {
+    throw new LunoraError("RPC `fanOut.merge.kind` is not a recognized merge strategy", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (merge.kind === "topK") {
+    if (typeof merge.k !== "number" || !Number.isInteger(merge.k) || merge.k < 0) {
+      throw new LunoraError("RPC `fanOut.merge.k` must be a non-negative integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof merge.by !== "string" || merge.by.length === 0) {
+      throw new LunoraError("RPC `fanOut.merge.by` must be a non-empty string", { code: "BAD_REQUEST", status: 400 });
+    }
+  }
+  return spec;
+};
+const parseEnvelope = async (request) => {
+  const text = await readBodyTextWithLimit(request);
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new LunoraError("RPC body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (!body || typeof body !== "object" || typeof body.functionPath !== "string") {
+    throw new LunoraError("RPC envelope is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
+  }
+  const raw = body;
+  if (raw.args !== void 0 && (typeof raw.args !== "object" || raw.args === null || Array.isArray(raw.args))) {
+    throw new LunoraError("RPC `args` must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (raw.shardKey !== void 0 && typeof raw.shardKey !== "string") {
+    throw new LunoraError("RPC `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
+  }
+  const envelope = body;
+  return {
+    args: envelope.args ?? {},
+    fanOut: validateFanOut(envelope.fanOut),
+    functionPath: envelope.functionPath,
+    shardKey: envelope.shardKey
+  };
+};
+const forwardToShard = async (namespace, shardKey, request) => {
+  const stub = resolveShard(namespace, shardKey);
+  return stub.fetch(request);
+};
+const constantTimeEqual = (expected, supplied) => {
+  const max = Math.max(expected.length, supplied.length);
+  let diff = expected.length ^ supplied.length;
+  for (let index = 0; index < max; index += 1) {
+    const expectedCode = index < expected.length ? expected.codePointAt(index) ?? 0 : 0;
+    const suppliedCode = index < supplied.length ? supplied.codePointAt(index) ?? 0 : 0;
+    diff |= expectedCode ^ suppliedCode;
+  }
+  return diff === 0;
+};
+const verifyHmacSignature = async (secret, body, suppliedSignature) => {
+  if (secret.length === 0 || suppliedSignature.length === 0) {
+    return false;
+  }
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
+  const bytes = new Uint8Array(signature);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCodePoint(byte);
+  }
+  const expected = btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+  return constantTimeEqual(expected, suppliedSignature);
+};
+const checkAdminAuth = (request, expected) => {
+  if (!expected || expected.length === 0) {
+    return false;
+  }
+  const authorization = request.headers.get("authorization");
+  if (!authorization) {
+    return false;
+  }
+  const [scheme, ...rest] = authorization.split(" ");
+  if (scheme?.toLowerCase() !== "bearer") {
+    return false;
+  }
+  return constantTimeEqual(expected, rest.join(" ").trim());
+};
+const checkAdminWsToken = (request, expected) => {
+  if (!expected || expected.length === 0) {
+    return false;
+  }
+  const supplied = new URL(request.url).searchParams.get("token");
+  return supplied !== null && constantTimeEqual(expected, supplied);
+};
+const createWorker = (options) => {
+  const defaultShard = options.defaultShardKey ?? "__root__";
+  const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
+  let warnedUnauthenticatedShardAccess = false;
+  const warnUnauthenticatedShardAccessOnce = (kind) => {
+    if (hasAnyShardAuth || options.allowUnauthenticatedShardAccess || warnedUnauthenticatedShardAccess) {
+      return;
+    }
+    warnedUnauthenticatedShardAccess = true;
+    console.warn(
+      [
+        `[lunora] SECURITY: received ${kind} access but neither \`authorizeShard\` nor \`authorizeFanOut\` is configured — `,
+        `any caller (including unauthenticated ones) can target any shard / fan out across the table. `,
+        `Configure \`authorizeShard\`/\`authorizeFanOut\`, or set \`allowUnauthenticatedShardAccess: true\` to acknowledge this posture and silence this warning.`
+      ].join("")
+    );
+  };
+  const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
+    defaultShard,
+    forwardToShard,
+    isAdmin: (request) => checkAdminAuth(request, options.adminToken),
+    queryCoordinator: options.queryCoordinator,
+    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
+    shardDO: options.shardDO
+  });
+  const dispatchToShard = async (functionPath, args, shardKey) => {
+    if (options.authorizeShard) {
+      const allowed = await options.authorizeShard(null, shardKey);
+      if (!allowed) {
+        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
+      }
+    }
+    const forwarded = new Request("https://shard.internal/rpc", {
+      // `x-lunora-system` marks this as a trusted server-initiated dispatch
+      // so the shard may run `internal` functions (scheduled/cron jobs are
+      // typically internal). Authorization was already enforced above; this
+      // header is set only here, never on the client RPC path.
+      body: JSON.stringify({ args, functionPath }),
+      headers: { "content-type": "application/json", "x-lunora-system": "1" },
+      method: "POST"
+    });
+    return forwardToShard(options.shardDO, shardKey, forwarded);
+  };
+  const startCronWorkflow = async (binding, job, env) => {
+    const candidate = env?.[binding];
+    if (!candidate || typeof candidate.create !== "function") {
+      throw new LunoraError(`cron job "${job.name}" targets workflow binding "${binding}", which is not bound on env`, {
+        code: "CRON_JOB_FAILED",
+        status: 500
+      });
+    }
+    await candidate.create({ params: job.args ?? {} });
+  };
+  const runOneCronJob = async (job, env) => {
+    if (job.workflow) {
+      await startCronWorkflow(job.workflow, job, env);
+      return;
+    }
+    if (job.functionPath === void 0) {
+      throw new LunoraError(`cron job "${job.name}" has neither a function target nor a workflow target`, {
+        code: "CRON_JOB_FAILED",
+        status: 500
+      });
+    }
+    const response = await dispatchToShard(job.functionPath, job.args ?? {}, job.shardKey ?? defaultShard);
+    if (!response.ok) {
+      throw new LunoraError(`cron job "${job.name}" (${job.functionPath}) failed with shard status ${String(response.status)}`, {
+        code: "CRON_JOB_FAILED",
+        status: 500
+      });
+    }
+  };
+  const runCronJobs = async (cron, env, errors, toError) => {
+    const cronJobs = options.cronJobs?.[cron];
+    if (!cronJobs) {
+      return;
+    }
+    for (const job of cronJobs) {
+      try {
+        await runOneCronJob(job, env);
+      } catch (error) {
+        errors.push(toError(error));
+      }
+    }
+  };
+  const handleRunCronJob = async (request, env) => {
+    if (!checkAdminAuth(request, options.adminToken)) {
+      throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+    if (request.method !== "POST") {
+      throw new LunoraError("cron-jobs run endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    if (!options.cronJobs) {
+      throw new LunoraError("cron-jobs run endpoint requires a `cronJobs` map on the worker", { code: "CRON_JOBS_NOT_CONFIGURED", status: 400 });
+    }
+    const body = await readJsonBodyWithLimit(request);
+    const name = typeof body.name === "string" ? body.name : "";
+    if (name === "") {
+      throw new LunoraError("cron-jobs run endpoint requires a job `name`", { code: "BAD_REQUEST", status: 400 });
+    }
+    const job = Object.values(options.cronJobs).flat().find((candidate) => candidate.name === name);
+    if (!job) {
+      throw new LunoraError(`no cron job named "${name}" is registered`, { code: "CRON_JOB_NOT_FOUND", status: 404 });
+    }
+    await runOneCronJob(job, env);
+    return Response.json({ name, ran: true }, { status: 200 });
+  };
+  const releasePoolSlot = async (candidate) => {
+    const pool = typeof candidate.pool === "string" && candidate.pool.length > 0 ? candidate.pool : void 0;
+    if (!pool || !options.schedulerDO || typeof candidate.id !== "string") {
+      return;
+    }
+    const instanceName = typeof candidate.instanceName === "string" && candidate.instanceName.length > 0 ? candidate.instanceName : "default";
+    try {
+      await options.schedulerDO.get(options.schedulerDO.idFromName(instanceName)).fetch(
+        new Request("https://scheduler.internal/complete", {
+          body: JSON.stringify({ id: candidate.id, pool }),
+          headers: { "content-type": "application/json" },
+          method: "POST"
+        })
+      );
+    } catch {
+    }
+  };
+  const handleSchedulerDispatch = async (request, env) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("Scheduler dispatch endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const rawBody = await readBodyTextWithLimit(request);
+    const envRecord = env ?? {};
+    const schedulerSecret = typeof envRecord["LUNORA_SCHEDULER_SECRET"] === "string" ? envRecord["LUNORA_SCHEDULER_SECRET"] : void 0;
+    const adminBearer = options.adminToken ?? (typeof envRecord["LUNORA_ADMIN_TOKEN"] === "string" ? envRecord["LUNORA_ADMIN_TOKEN"] : void 0);
+    const signatureHeader = request.headers.get("x-lunora-scheduler-signature");
+    let authenticated = false;
+    if (signatureHeader && schedulerSecret) {
+      authenticated = await verifyHmacSignature(schedulerSecret, rawBody, signatureHeader);
+    } else if (adminBearer) {
+      authenticated = checkAdminAuth(request, adminBearer);
+    }
+    if (!authenticated) {
+      throw new LunoraError("Scheduler dispatch requires a valid signature or admin bearer", { code: "FORBIDDEN", status: 403 });
+    }
+    let body;
+    try {
+      body = JSON.parse(rawBody);
+    } catch {
+      throw new LunoraError("Scheduler dispatch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+    }
+    const candidate = body ?? {};
+    if (typeof candidate.functionPath !== "string" || candidate.functionPath.length === 0) {
+      throw new LunoraError("Scheduler dispatch is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
+    }
+    const args = candidate.args ?? {};
+    const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
+    const response = await dispatchToShard(candidate.functionPath, args, shardKey);
+    await releasePoolSlot(candidate);
+    return response;
+  };
+  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
+    applyGlobals: options.applyGlobals,
+    isAdmin: (request) => checkAdminAuth(request, options.adminToken),
+    knownTables: () => collectKnownTables(),
+    queryCoordinator: options.queryCoordinator,
+    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
+    shardDO: options.shardDO,
+    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow),
+    streamingImport: (request, headers) => streamingImport(request, options, headers),
+    syncGlobals: options.syncGlobals
+  });
+  const assertAdminAuthorized = (request) => {
+    if (!checkAdminAuth(request, options.adminToken)) {
+      throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
+    }
+  };
+  const requireAdminOption = (request, value, notConfigured) => {
+    assertAdminAuthorized(request);
+    if (value === void 0) {
+      throw new LunoraError(notConfigured.message, { code: notConfigured.code, status: 400 });
+    }
+    return value;
+  };
+  const queryParameter = (url, name) => {
+    const value = url.searchParams.get(name);
+    return value === null || value === "" ? void 0 : value;
+  };
+  const parsePaging = (request) => {
+    const url = new URL(request.url);
+    const limitParameter = url.searchParams.get("limit");
+    const offsetParameter = url.searchParams.get("offset");
+    const limit = limitParameter === null ? void 0 : Number.parseInt(limitParameter, 10);
+    const offset = offsetParameter === null ? void 0 : Number.parseInt(offsetParameter, 10);
+    return {
+      limit: limit !== void 0 && Number.isFinite(limit) && limit >= 0 ? limit : void 0,
+      offset: offset !== void 0 && Number.isFinite(offset) && offset >= 0 ? offset : void 0
+    };
+  };
+  const requireSchedulerNamespace = () => {
+    if (options.schedulerDO === void 0) {
+      throw new LunoraError("scheduled endpoints require a `schedulerDO` namespace on the worker", { code: "SCHEDULER_NOT_CONFIGURED", status: 400 });
+    }
+    return options.schedulerDO;
+  };
+  const resolveSchedulerStub = (request) => {
+    assertAdminAuthorized(request);
+    return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
+  };
+  const scheduledAdminRoutes = buildScheduledAdminRoutes({
+    checkWsAdmin: (request) => checkAdminAuth(request, options.adminToken) || checkAdminWsToken(request, options.adminToken),
+    requireSchedulerNamespace,
+    resolveSchedulerStub,
+    schedulerInstanceName: options.schedulerInstanceName ?? "default"
+  });
+  const workflowsAdminRoutes = buildWorkflowsAdminRoutes({
+    assertAdmin: assertAdminAuthorized,
+    resolveWorkflowsClient: options.workflowsClient ?? (() => void 0)
+  });
+  const storageAdminRoutes = buildStorageAdminRoutes({
+    assertAdmin: assertAdminAuthorized,
+    parsePaging,
+    queryParameter,
+    readBodyBytes: readBodyBytesWithLimit,
+    requireAdminOption,
+    storage: {
+      storageBuckets: options.storageBuckets,
+      storageDelete: options.storageDelete,
+      storageList: options.storageList,
+      storageSignedUrl: options.storageSignedUrl,
+      storageUpload: options.storageUpload
+    }
+  });
+  const vectorAdminRoutes = buildVectorAdminRoutes({
+    readJsonBody: readJsonBodyWithLimit,
+    requireAdminOption,
+    vectorIntrospector: options.vectorIntrospector
+  });
+  const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
+    assertAdmin: assertAdminAuthorized,
+    options: {
+      cronJobs: options.cronJobs,
+      functions: options.functions,
+      globalIntrospector: options.globalIntrospector,
+      openApiSpec: options.openApiSpec,
+      openRpcSpec: options.openRpcSpec
+    },
+    parsePaging,
+    queryParameter,
+    requireAdminOption
+  });
+  const buildHttpActionContext = async (request, env) => {
+    const { claims, headers, userId } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const run = async (reference, args = {}) => {
+      const functionPath = reference.__lunoraRef;
+      if (typeof functionPath !== "string") {
+        throw new LunoraError("ctx.run*: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
+      }
+      const forwarded = new Request("https://shard.internal/rpc", {
+        body: JSON.stringify({ args, functionPath }),
+        headers,
+        method: "POST"
+      });
+      const response = await forwardToShard(options.shardDO, defaultShard, forwarded);
+      const payload = await response.json();
+      if (payload.error) {
+        throw new LunoraError(payload.error.message ?? "shard RPC failed", {
+          code: payload.error.code ?? "INTERNAL",
+          status: response.status
+        });
+      }
+      return payload.result;
+    };
+    return {
+      auth: {
+        getIdentity: () => Promise.resolve(claims),
+        userId
+      },
+      fetch: globalThis.fetch.bind(globalThis),
+      runAction: run,
+      runMutation: run,
+      runQuery: run
+    };
+  };
+  const dispatchHttpRoute = async (request, env, context) => {
+    if (!options.httpRouter) {
+      return void 0;
+    }
+    const httpContext = await buildHttpActionContext(request, env);
+    try {
+      return await options.httpRouter.fetch(request, { ...env, __lunoraCtx: httpContext }, context);
+    } catch (error) {
+      console.error("[lunora] httpRouter (SSR) handler threw:", error);
+      return new Response("Internal Server Error", { status: 500 });
+    }
+  };
+  const handleWebSocketUpgrade = async (request, env, url) => {
+    if (request.headers.get("Upgrade") !== "websocket") {
+      throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
+    }
+    const shardKey = url.searchParams.get("shard") ?? defaultShard;
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    if (options.authorizeShard) {
+      const allowed = await options.authorizeShard(identity, shardKey);
+      if (!allowed) {
+        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
+      }
+    } else if (shardKey !== defaultShard) {
+      warnUnauthenticatedShardAccessOnce("shard");
+    }
+    const upgradeHeaders = new Headers(request.headers);
+    upgradeHeaders.delete("x-lunora-userid");
+    upgradeHeaders.delete("x-lunora-identity");
+    upgradeHeaders.delete("x-lunora-identity-exp");
+    const forwardedUserId = forwardedHeaders["x-lunora-userid"];
+    const forwardedIdentity = forwardedHeaders["x-lunora-identity"];
+    const forwardedExp = forwardedHeaders["x-lunora-identity-exp"];
+    if (forwardedUserId !== void 0) {
+      upgradeHeaders.set("x-lunora-userid", forwardedUserId);
+    }
+    if (forwardedIdentity !== void 0) {
+      upgradeHeaders.set("x-lunora-identity", forwardedIdentity);
+    }
+    if (forwardedExp !== void 0) {
+      upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
+    }
+    return forwardToShard(options.shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
+  };
+  const authorizeRpcEnvelope = async (envelope, identity) => {
+    if (envelope.fanOut) {
+      if (options.authorizeFanOut) {
+        const allowed = await options.authorizeFanOut(identity, envelope.fanOut.table, envelope.functionPath);
+        if (!allowed) {
+          throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
+        }
+      } else if (envelope.functionPath.startsWith("__lunora_relation__:")) {
+        throw new LunoraError(
+          "reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker",
+          {
+            code: "FORBIDDEN_FANOUT",
+            status: 403
+          }
+        );
+      } else if (options.authorizeShard) {
+        throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
+          code: "FORBIDDEN_FANOUT",
+          status: 403
+        });
+      } else {
+        warnUnauthenticatedShardAccessOnce("fan-out");
+      }
+      return;
+    }
+    if (options.authorizeShard) {
+      const shardKeyForAuth = envelope.shardKey ?? defaultShard;
+      const allowed = await options.authorizeShard(identity, shardKeyForAuth);
+      if (!allowed) {
+        throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
+      }
+    } else if (envelope.shardKey !== void 0 && envelope.shardKey !== defaultShard) {
+      warnUnauthenticatedShardAccessOnce("shard");
+    }
+  };
+  const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
+    const rpcStartedAt = Date.now();
+    const { observability } = options;
+    const forwarded = new Request(`https://shard.internal/rpc`, {
+      body: JSON.stringify({ args, functionPath }),
+      headers: forwardedHeaders,
+      method: "POST"
+    });
+    try {
+      const response = await forwardToShard(options.shardDO, shardKey, forwarded);
+      emitRpcEvent(
+        observability,
+        {
+          durationMs: Date.now() - rpcStartedAt,
+          functionPath,
+          ok: response.ok,
+          shardKey,
+          ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
+        },
+        sinkContext
+      );
+      const responseBookmark = response.headers.get("x-d1-bookmark");
+      if (responseBookmark) {
+        const headers = new Headers(response.headers);
+        headers.set("x-d1-bookmark", responseBookmark);
+        return new Response(response.body, { headers, status: response.status });
+      }
+      return response;
+    } catch (error) {
+      emitRpcEvent(observability, buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), sinkContext);
+      throw error;
+    }
+  };
+  const handleRpc = async (request, env, context) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const envelope = await parseEnvelope(request);
+    if (envelope.fanOut && envelope.shardKey) {
+      throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
+      throw new LunoraError("`__lunora_relation__:*` is a fan-out-only reserved RPC and cannot be dispatched to a single shard", {
+        code: "FORBIDDEN",
+        status: 403
+      });
+    }
+    if (envelope.fanOut && !options.queryCoordinator) {
+      throw new LunoraError("RPC envelope set `fanOut` but no `queryCoordinator` is configured on the worker", {
+        code: "BAD_REQUEST",
+        status: 400
+      });
+    }
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    await authorizeRpcEnvelope(envelope, identity);
+    {
+      const rpcStartedAt = Date.now();
+      const { observability } = options;
+      const sinkContext = context ? {
+        waitUntil: (promise) => {
+          context.waitUntil(promise);
+        }
+      } : void 0;
+      if (envelope.fanOut) {
+        const coordinator = options.queryCoordinator;
+        if (!coordinator) {
+          throw new LunoraError("RPC envelope set `fanOut` but no `queryCoordinator` is configured on the worker", {
+            code: "BAD_REQUEST",
+            status: 400
+          });
+        }
+        try {
+          const result = await coordinator.fanOut(options.shardDO, {
+            args: envelope.args ?? {},
+            fanOut: envelope.fanOut,
+            functionPath: envelope.functionPath,
+            headers: forwardedHeaders
+          });
+          emitRpcEvent(
+            observability,
+            {
+              durationMs: Date.now() - rpcStartedAt,
+              fanOut: {
+                failed: result.failed,
+                shards: result.ok + result.failed,
+                table: envelope.fanOut.table
+              },
+              functionPath: envelope.functionPath,
+              ok: true
+            },
+            sinkContext
+          );
+          return Response.json(result, {
+            headers: { "content-type": "application/json" },
+            status: 200
+          });
+        } catch (error) {
+          emitRpcEvent(
+            observability,
+            buildErrorEvent(envelope.functionPath, Date.now() - rpcStartedAt, error, { fanOut: { table: envelope.fanOut.table } }),
+            sinkContext
+          );
+          throw error;
+        }
+      }
+      const shardKey = envelope.shardKey ?? defaultShard;
+      return dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+    }
+  };
+  const serverQuery = async (request, env, reference, args = {}, callOptions = {}) => {
+    try {
+      const functionPath = reference.__lunoraRef;
+      if (typeof functionPath !== "string") {
+        throw new LunoraError("serverQuery: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
+      }
+      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+      await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
+      const shardKey = callOptions.shardKey ?? defaultShard;
+      return await dispatchSingleShard(functionPath, args, shardKey, forwardedHeaders);
+    } catch (error) {
+      return toErrorResponse(error);
+    }
+  };
+  const MAX_PRUNE_PAGES = 1e3;
+  const pruneBackups = async (store, prefix) => {
+    const retain = options.backupRetain;
+    if (retain === void 0 || retain <= 0) {
+      return;
+    }
+    const manifestKeys = [];
+    let cursor;
+    for (let page = 0; page < MAX_PRUNE_PAGES; page += 1) {
+      const listing = await store.list({ cursor, prefix });
+      for (const object of listing.objects) {
+        if (object.key.endsWith(".manifest.json")) {
+          manifestKeys.push(object.key);
+        }
+      }
+      if (!listing.truncated || listing.cursor === void 0) {
+        break;
+      }
+      cursor = listing.cursor;
+    }
+    const stale = manifestKeys.toSorted((a, b) => b.localeCompare(a)).slice(retain);
+    await Promise.all(
+      stale.flatMap((manifestKey) => {
+        const ndjsonKey = manifestKey.slice(0, -".manifest.json".length);
+        return [store.delete(manifestKey), store.delete(ndjsonKey)];
+      })
+    );
+  };
+  const runScheduledBackup = async (controller) => {
+    const store = options.backupStore;
+    const coordinator = options.queryCoordinator;
+    if (!store) {
+      throw new LunoraError("scheduled backup requires a `backupStore` on the worker", { code: "BACKUP_NOT_CONFIGURED", status: 500 });
+    }
+    if (!coordinator) {
+      throw new LunoraError("scheduled backup requires a `queryCoordinator` on the worker", { code: "BACKUP_NOT_CONFIGURED", status: 500 });
+    }
+    if (!options.adminToken || options.adminToken.length === 0) {
+      throw new LunoraError("scheduled backup requires an `adminToken` to authenticate the per-shard export gate", {
+        code: "BACKUP_NOT_CONFIGURED",
+        status: 500
+      });
+    }
+    const forwardedHeaders = { authorization: `Bearer ${options.adminToken}`, "content-type": "application/json" };
+    const tables = options.backupTables;
+    let rows = 0;
+    let bytes = 0;
+    let streamError;
+    const stream = new ReadableStream({
+      async pull(streamController) {
+        const writeRow = (row) => {
+          const encoded = NDJSON_ENCODER.encode(`${JSON.stringify(row)}
+`);
+          rows += 1;
+          bytes += encoded.byteLength;
+          streamController.enqueue(encoded);
+        };
+        try {
+          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow);
+          streamController.close();
+        } catch (error) {
+          streamError = error instanceof Error ? error : new Error(String(error));
+          streamController.error(error);
+        }
+      }
+    });
+    const prefix = options.backupPrefix ?? "backups/";
+    const timestamp = new Date(controller.scheduledTime).toISOString();
+    const fileKey = `${prefix}lunora-backup-${timestamp.replaceAll(/[.:]/gu, "-")}.ndjson`;
+    const manifestKey = `${fileKey}.manifest.json`;
+    await store.put(fileKey, stream, { httpMetadata: { contentType: "application/x-ndjson" } });
+    if (streamError !== void 0) {
+      throw streamError;
+    }
+    const manifest = {
+      bytes,
+      createdAt: timestamp,
+      cron: controller.cron,
+      file: fileKey,
+      id: timestamp,
+      rows,
+      scheduledTime: controller.scheduledTime,
+      ...tables ? { tables: tables.join(",") } : {}
+    };
+    await store.put(manifestKey, `${JSON.stringify(manifest, void 0, 2)}
+`, { httpMetadata: { contentType: "application/json" } });
+    await pruneBackups(store, prefix);
+  };
+  const handleScheduled = async (controller, env, context) => {
+    const errors = [];
+    const toError = (error) => error instanceof Error ? error : new Error(String(error));
+    const userHandler = options.crons?.[controller.cron];
+    if (userHandler) {
+      try {
+        await userHandler(controller, env, context);
+      } catch (error) {
+        errors.push(toError(error));
+      }
+    }
+    await runCronJobs(controller.cron, env, errors, toError);
+    if (options.backupStore && options.backupCron !== void 0 && options.backupCron === controller.cron) {
+      try {
+        await runScheduledBackup(controller);
+      } catch (error) {
+        errors.push(toError(error));
+      }
+    }
+    const [first] = errors;
+    if (errors.length === 1 && first) {
+      throw first;
+    }
+    if (errors.length > 1) {
+      throw new AggregateError(errors, `scheduled("${controller.cron}") had ${String(errors.length)} failure(s)`);
+    }
+  };
+  const recordAuthAttempt = async (env, outcome) => {
+    try {
+      const envRecord = env ?? {};
+      const adminBearer = options.adminToken ?? (typeof envRecord["LUNORA_ADMIN_TOKEN"] === "string" ? envRecord["LUNORA_ADMIN_TOKEN"] : void 0);
+      if (!adminBearer || adminBearer.length === 0) {
+        return;
+      }
+      const recordRequest = new Request("https://shard.internal/rpc", {
+        body: JSON.stringify({ args: { outcome }, functionPath: RECORD_AUTH_EVENT_OP }),
+        headers: { authorization: `Bearer ${adminBearer}`, "content-type": "application/json" },
+        method: "POST"
+      });
+      await forwardToShard(options.shardDO, defaultShard, recordRequest);
+    } catch {
+    }
+  };
+  const dispatchAuth = async (request, env, url, context) => {
+    if (!options.authHandler) {
+      return void 0;
+    }
+    const authResponse = await options.authHandler(request);
+    if (!authResponse) {
+      return void 0;
+    }
+    const basePath = options.authBasePath ?? DEFAULT_AUTH_BASE_PATH;
+    if (isAuthAttemptPath(url.pathname, basePath)) {
+      context.waitUntil(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
+    }
+    return authResponse;
+  };
+  const internalRoutes = {
+    [WS_PATH]: (request, env, url) => handleWebSocketUpgrade(request, env, url),
+    [RPC_PATH]: (request, env, _url, context) => handleRpc(request, env, context),
+    [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
+    [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
+    // Extracted handler clusters built above, merged in (mirroring the auth
+    // plane below): orchestration (migrate / rank / rankpage / shard-traffic /
+    // pitr), data-movement (export / import / sync / connector-sync / apply),
+    // scheduled, storage, vector, and the static-introspection reads
+    // (functions / cron-jobs / openapi / openrpc / global tables).
+    ...orchestrationAdminRoutes,
+    ...dataMovementAdminRoutes,
+    ...scheduledAdminRoutes,
+    ...workflowsAdminRoutes,
+    ...storageAdminRoutes,
+    ...vectorAdminRoutes,
+    ...introspectionAdminRoutes,
+    // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
+    // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
+    ...buildAuthAdminRoutes({
+      assertAdmin: assertAdminAuthorized,
+      // eslint-disable-next-line sonarjs/deprecation -- `authIntrospector` is the intentional read-only fallback
+      getAuthAdmin: () => options.authAdmin ?? options.authIntrospector,
+      parsePaging,
+      queryParameter,
+      readJsonBody: readJsonBodyWithLimit
+    })
+  };
+  let resolvedSecurity = resolveSecurity(options.security);
+  let securityEnvResolved = false;
+  const ensureSecurityResolved = (env) => {
+    if (!securityEnvResolved) {
+      securityEnvResolved = true;
+      resolvedSecurity = resolveSecurity(options.security, env ?? {});
+    }
+  };
+  const handle = async (request, env, context) => {
+    const url = new URL(request.url);
+    if (request.method === "POST" || request.method === "PUT") {
+      const contentLength = Number(request.headers.get("content-length") ?? "");
+      if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) {
+        throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
+      }
+    }
+    const authResponse = await dispatchAuth(request, env, url, context);
+    if (authResponse) {
+      return authResponse;
+    }
+    const methodAndPath = `${request.method} ${url.pathname}`;
+    const route = options.routes?.[methodAndPath] ?? options.routes?.[url.pathname];
+    if (route) {
+      return route(request, env, context);
+    }
+    const internalRoute = internalRoutes[url.pathname];
+    if (internalRoute) {
+      return internalRoute(request, env, url, context);
+    }
+    const httpRouteResponse = await dispatchHttpRoute(request, env, context);
+    if (httpRouteResponse) {
+      return httpRouteResponse;
+    }
+    return new Response("Not found", { status: 404 });
+  };
+  return {
+    async fetch(request, env, context) {
+      if (options.passThroughOnException) {
+        context.passThroughOnException();
+      }
+      ensureSecurityResolved(env);
+      const preflight = handleCorsPreflight(request, resolvedSecurity);
+      if (preflight) {
+        return preflight;
+      }
+      const blocked = enforceOrigin(request, resolvedSecurity);
+      if (blocked) {
+        return decorateResponse(blocked, request, resolvedSecurity);
+      }
+      try {
+        const response = await handle(request, env, context);
+        return decorateResponse(response, request, resolvedSecurity);
+      } catch (error) {
+        return decorateResponse(toErrorResponse(error), request, resolvedSecurity);
+      }
+    },
+    async scheduled(controller, env, context) {
+      await handleScheduled(controller, env, context);
+    },
+    serverQuery
+  };
+};
+const composeWorker = (options) => createWorker(options);
+const toHttpRouter = (handler) => typeof handler === "function" ? { fetch: handler } : handler;
+const hasLunoraCrons = (options) => Boolean(options.crons ?? options.cronJobs ?? options.backupCron);
+const withFrameworkWorker = (host, optionsInput) => {
+  const httpRouter = toHttpRouter(host);
+  const hostScheduled = typeof host === "object" && typeof host.scheduled === "function" ? host.scheduled : void 0;
+  const build = (options) => {
+    const lunora = composeWorker({ ...options, httpRouter });
+    if (hostScheduled !== void 0 && !hasLunoraCrons(options)) {
+      return {
+        ...lunora,
+        scheduled: async (controller, env, context) => {
+          await hostScheduled(controller, env, context);
+        }
+      };
+    }
+    return lunora;
+  };
+  if (typeof optionsInput !== "function") {
+    return build(optionsInput);
+  }
+  const optionsFactory = optionsInput;
+  return {
+    fetch: (request, env, context) => build(optionsFactory(env)).fetch(request, env, context),
+    scheduled: (controller, env, context) => build(optionsFactory(env)).scheduled(controller, env, context),
+    serverQuery: (request, env, reference, args, options) => build(optionsFactory(env)).serverQuery(request, env, reference, args, options)
+  };
+};
+const defineRpcEnvelope = (envelope) => envelope;
+
+export { composeWorker, createWorker, defineRpcEnvelope, withFrameworkWorker };