@lunora/runtime 1.0.0-alpha.1 → 1.0.0-alpha.2

package/dist/index.mjs

@@ -1,10 +1,10 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createWorker, defineRpcEnvelope, withFrameworkWorker } from './packem_shared/composeWorker-BYHiNH_V.mjs';
+export { composeWorker, createWorker, defineRpcEnvelope, withFrameworkWorker } from './packem_shared/composeWorker-BmfKl1ei.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
-export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/createDynamicShardRegistry-BpCwo_mo.mjs';
+export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-BpCwo_mo.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
-export { emitLogEvent, emitRpcEvent } from './packem_shared/emitRpcEvent-pEdtqAK8.mjs';
-export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/consoleSink-DqEvrQs0.mjs';
+export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK8.mjs';
+export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-DbxC7iUz.mjs';
 export { resolveShard } from './packem_shared/resolveShard-DDkzWtrU.mjs';
 export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DbISh_Wi.mjs';

package/dist/packem_shared/{composeWorker-BYHiNH_V.mjs → composeWorker-BmfKl1ei.mjs}

@@ -1,5 +1,5 @@
 import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
-import { emitRpcEvent } from './emitRpcEvent-pEdtqAK8.mjs';
+import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard } from './resolveShard-DDkzWtrU.mjs';
 import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
 
@@ -1740,6 +1740,17 @@ const checkAdminWsToken = (request, expected) => {
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
+  let envAdminToken;
+  const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
+  const resolveAdminTokenFromEnv = (env) => {
+    if (envAdminToken !== void 0 || options.adminToken !== void 0) {
+      return;
+    }
+    const value = (env ?? {})["LUNORA_ADMIN_TOKEN"];
+    if (typeof value === "string" && value.length > 0) {
+      envAdminToken = value;
+    }
+  };
   const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
   let warnedUnauthenticatedShardAccess = false;
   const warnUnauthenticatedShardAccessOnce = (kind) => {
@@ -1758,7 +1769,7 @@ const createWorker = (options) => {
   const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
     defaultShard,
     forwardToShard,
-    isAdmin: (request) => checkAdminAuth(request, options.adminToken),
+    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
     queryCoordinator: options.queryCoordinator,
     resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
     shardDO: options.shardDO
@@ -1824,7 +1835,7 @@ const createWorker = (options) => {
     }
   };
   const handleRunCronJob = async (request, env) => {
-    if (!checkAdminAuth(request, options.adminToken)) {
+    if (!checkAdminAuth(request, effectiveAdminToken())) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     if (request.method !== "POST") {
@@ -1898,7 +1909,7 @@ const createWorker = (options) => {
   };
   const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
     applyGlobals: options.applyGlobals,
-    isAdmin: (request) => checkAdminAuth(request, options.adminToken),
+    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
     knownTables: () => collectKnownTables(),
     queryCoordinator: options.queryCoordinator,
     resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
@@ -1908,7 +1919,7 @@ const createWorker = (options) => {
     syncGlobals: options.syncGlobals
   });
   const assertAdminAuthorized = (request) => {
-    if (!checkAdminAuth(request, options.adminToken)) {
+    if (!checkAdminAuth(request, effectiveAdminToken())) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
   };
@@ -1945,7 +1956,7 @@ const createWorker = (options) => {
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => checkAdminAuth(request, options.adminToken) || checkAdminWsToken(request, options.adminToken),
+    checkWsAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()) || checkAdminWsToken(request, effectiveAdminToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -2435,6 +2446,7 @@ const createWorker = (options) => {
         context.passThroughOnException();
       }
       ensureSecurityResolved(env);
+      resolveAdminTokenFromEnv(env);
       const preflight = handleCorsPreflight(request, resolvedSecurity);
       if (preflight) {
         return preflight;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.2",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",