@lunora/runtime 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/index.d.mts

@@ -446,6 +446,72 @@ interface IdentityContractLike {
 * the wrapped resolver; the admin path keeps the raw one (admin is gated by the
 * bearer / Access, not the app's identity contract).
 */
+/** One KV namespace as the studio's KV browser surfaces it. */
+interface KvNamespaceSummary {
+  /** The wrangler/env binding name, e.g. `"MY_KV"`. */
+  binding: string;
+}
+/** One key entry as the KV admin browser surfaces it. */
+interface KvKeyEntry {
+  /** Absolute expiration (Unix seconds), when set. */
+  expiration?: number;
+  /** Per-key metadata set at write time, or absent when none. */
+  metadata?: unknown;
+  /** The key name. */
+  name: string;
+}
+/** A paginated page of KV keys as the admin browser returns it. */
+interface KvKeyListResult {
+  /** Opaque cursor for the next page; absent when the listing is complete. */
+  cursor?: string;
+  /** The keys on this page. */
+  keys: KvKeyEntry[];
+  /** True when this is the final page. */
+  listComplete: boolean;
+}
+/** A KV value together with its stored metadata. */
+interface KvValueResult {
+  /** Per-key metadata, or `null` when none. */
+  metadata: unknown;
+  /** The stored value as a string, or `null` when the key is absent. */
+  value: null | string;
+}
+/**
+* The introspector the worker wires for the studio's KV browser. Build it from
+* the env's bound KV namespaces. Omit it and the `/_lunora/admin/kv/*`
+* endpoints respond `KV_NOT_CONFIGURED`.
+*/
+interface KvIntrospector {
+  /** Delete a key from a namespace. No-op when the key is absent. */
+  deleteKey: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<void>;
+  /** Read a value (as text) and its metadata from a namespace key. */
+  getValue: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<KvValueResult>;
+  /** List keys in a namespace, optionally filtered by prefix and paginated. */
+  listKeys: (options: {
+    cursor?: string;
+    limit?: number;
+    namespace: string;
+    prefix?: string;
+  }) => Promise<KvKeyListResult>;
+  /** List the registered KV namespaces (binding names). */
+  listNamespaces: () => Promise<KvNamespaceSummary[]>;
+  /** Write a value (as text) with optional absolute expiration / relative TTL and metadata. */
+  putValue: (options: {
+    expiration?: number;
+    expirationTtl?: number;
+    key: string;
+    metadata?: unknown;
+    namespace: string;
+    value: string;
+  }) => Promise<void>;
+}
+/** The worker internals the KV routes reach through injection rather than closure. */
 /**
 * Observability hooks for the Lunora runtime.
 *
@@ -1150,9 +1216,13 @@ declare const createQueryCoordinator: (options: QueryCoordinatorOptions) => Quer
 interface SecurityHeadersOptions {
   /**
   * `Content-Security-Policy`. Omitted (`undefined`) applies a restrictive
-  * default to **non-HTML** responses only, so an SSR page is never broken by
-  * a policy it didn't opt into. Pass a string to apply that policy to every
-  * response (HTML included); `false` to never send one.
+  * `default-src 'none'` policy to **non-HTML** responses, and a conservative
+  * hardening policy to **HTML** responses (`base-uri 'none'; frame-ancestors
+  * 'self'; object-src 'none'`) — this does NOT set `default-src`/`script-src`,
+  * so it never blocks an SSR page's own scripts/styles/images/fetches, it only
+  * locks down the `base` element, framing (mirroring the `SAMEORIGIN`
+  * X-Frame-Options default), and legacy plugins. Pass a string to apply that
+  * exact policy to every response (HTML included); `false` to never send one.
   */
   csp?: string | false;
   /** `X-Frame-Options` (clickjacking). Defaults to `SAMEORIGIN`. `false` omits it. */
@@ -1201,7 +1271,7 @@ interface SecurityOptions {
 interface ResolvedHeaders {
   coop: string | undefined;
   csp: {
-    htmlToo: boolean;
+    htmlValue: string | undefined;
     value: string;
   } | undefined;
   enabled: boolean;
@@ -1264,6 +1334,24 @@ declare const resolveSecurity: (security: SecurityOptions | undefined, env?: Rec
 * @returns a `403` Response when the origin is untrusted, or `undefined` when the request is allowed.
 */
 declare const enforceOrigin: (request: Request, resolved: ResolvedSecurity) => Response | undefined;
+/**
+* CSRF defense for the WebSocket upgrade (Cross-Site WebSocket Hijacking).
+*
+* A WS handshake is an HTTP `GET`, so {@link enforceOrigin}'s safe-method
+* exemption never fires for it — yet the browser auto-attaches the session
+* cookie to the handshake and WebSocket connections are NOT governed by
+* CORS/SOP. Without an explicit `Origin` check any page can open
+* `wss://app/_lunora/ws`, authenticate as the logged-in victim, and read the
+* victim's live queries + issue mutations as them. This guard closes that hole.
+*
+* Scoped to cookie-bearing upgrades — the only vector CSWSH can ride (a browser
+* attaches cookies but never a bearer token). Bearer/token/server-to-server
+* upgrades (no `Cookie`) are exempt. A browser ALWAYS sends `Origin` on a WS
+* handshake, so a missing/untrusted `Origin` on a cookie-bearing upgrade fails
+* closed (mirrors {@link enforceOrigin}).
+* @returns a `403` Response when the upgrade origin is untrusted, or `undefined` when it is allowed.
+*/
+
 /**
 * Answer a CORS preflight (`OPTIONS` carrying `Access-Control-Request-Method`)
 * for an allowlisted origin with a `204`. Returns `undefined` for non-preflight
@@ -1718,17 +1806,21 @@ interface WorkerOptions {
   */
   adminToken?: string;
   /**
-  * Acknowledge — explicitly — that sharded and fan-out access may be
-  * exercised by any caller (including unauthenticated ones) because no
-  * authorization callback is configured. When neither {@link WorkerOptions.authorizeShard}
-  * nor {@link WorkerOptions.authorizeFanOut} is set, naming a non-default shard or sending
-  * a fan-out envelope is authorization-open: this is the historical posture,
-  * preserved for backward compatibility. The runtime emits a single loud
-  * `console.warn` the first time such a request is seen so the gap is
-  * visible in logs. Set this to `true` to assert the posture is intentional
-  * and silence that warning. It does NOT change behaviour — it is purely an
-  * acknowledgement flag — and has no effect once an `authorize*` callback is
-  * configured.
+  * Opt into an authorization-open posture for sharded and fan-out access.
+  *
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
+  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
+  * is configured, naming a non-default shard (a potential cross-tenant hop)
+  * or sending a fan-out envelope is rejected with a `403`
+  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
+  * requests from any caller (including unauthenticated ones) — appropriate
+  * only when every table is protected by per-row RLS. The runtime then emits
+  * a single `console.warn` so the open posture stays visible in logs. Has no
+  * effect once an `authorize*` callback is configured (those gate directly).
+  *
+  * NOTE: this is a behaviour change from earlier alphas, where the same
+  * situation was warn-once-then-allow. Apps that relied on client-chosen
+  * shard keys without an `authorize*` callback must set this flag explicitly.
   */
   allowUnauthenticatedShardAccess?: boolean;
   /**
@@ -1932,6 +2024,14 @@ interface WorkerOptions {
   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
+  * Introspector for Workers KV namespaces, backing the studio's KV browser
+  * via `GET /_lunora/admin/kv/namespaces`, `GET /_lunora/admin/kv/keys`,
+  * `GET|PUT|DELETE /_lunora/admin/kv/value`. Build it from the env's bound
+  * KV namespaces with `createKvIntrospector` from `@lunora/bindings/kv`.
+  * Omit it and those endpoints respond `KV_NOT_CONFIGURED`.
+  */
+  kvIntrospector?: KvIntrospector;
+  /**
   * Optional telemetry sink. When supplied, the worker emits one
   * `onRpc` event per dispatched RPC (single-shard forward or fan-out)
   * with duration / ok / error / shardKey or fanOut metadata. Sink
@@ -2515,4 +2615,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -446,6 +446,72 @@ interface IdentityContractLike {
 * the wrapped resolver; the admin path keeps the raw one (admin is gated by the
 * bearer / Access, not the app's identity contract).
 */
+/** One KV namespace as the studio's KV browser surfaces it. */
+interface KvNamespaceSummary {
+  /** The wrangler/env binding name, e.g. `"MY_KV"`. */
+  binding: string;
+}
+/** One key entry as the KV admin browser surfaces it. */
+interface KvKeyEntry {
+  /** Absolute expiration (Unix seconds), when set. */
+  expiration?: number;
+  /** Per-key metadata set at write time, or absent when none. */
+  metadata?: unknown;
+  /** The key name. */
+  name: string;
+}
+/** A paginated page of KV keys as the admin browser returns it. */
+interface KvKeyListResult {
+  /** Opaque cursor for the next page; absent when the listing is complete. */
+  cursor?: string;
+  /** The keys on this page. */
+  keys: KvKeyEntry[];
+  /** True when this is the final page. */
+  listComplete: boolean;
+}
+/** A KV value together with its stored metadata. */
+interface KvValueResult {
+  /** Per-key metadata, or `null` when none. */
+  metadata: unknown;
+  /** The stored value as a string, or `null` when the key is absent. */
+  value: null | string;
+}
+/**
+* The introspector the worker wires for the studio's KV browser. Build it from
+* the env's bound KV namespaces. Omit it and the `/_lunora/admin/kv/*`
+* endpoints respond `KV_NOT_CONFIGURED`.
+*/
+interface KvIntrospector {
+  /** Delete a key from a namespace. No-op when the key is absent. */
+  deleteKey: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<void>;
+  /** Read a value (as text) and its metadata from a namespace key. */
+  getValue: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<KvValueResult>;
+  /** List keys in a namespace, optionally filtered by prefix and paginated. */
+  listKeys: (options: {
+    cursor?: string;
+    limit?: number;
+    namespace: string;
+    prefix?: string;
+  }) => Promise<KvKeyListResult>;
+  /** List the registered KV namespaces (binding names). */
+  listNamespaces: () => Promise<KvNamespaceSummary[]>;
+  /** Write a value (as text) with optional absolute expiration / relative TTL and metadata. */
+  putValue: (options: {
+    expiration?: number;
+    expirationTtl?: number;
+    key: string;
+    metadata?: unknown;
+    namespace: string;
+    value: string;
+  }) => Promise<void>;
+}
+/** The worker internals the KV routes reach through injection rather than closure. */
 /**
 * Observability hooks for the Lunora runtime.
 *
@@ -1150,9 +1216,13 @@ declare const createQueryCoordinator: (options: QueryCoordinatorOptions) => Quer
 interface SecurityHeadersOptions {
   /**
   * `Content-Security-Policy`. Omitted (`undefined`) applies a restrictive
-  * default to **non-HTML** responses only, so an SSR page is never broken by
-  * a policy it didn't opt into. Pass a string to apply that policy to every
-  * response (HTML included); `false` to never send one.
+  * `default-src 'none'` policy to **non-HTML** responses, and a conservative
+  * hardening policy to **HTML** responses (`base-uri 'none'; frame-ancestors
+  * 'self'; object-src 'none'`) — this does NOT set `default-src`/`script-src`,
+  * so it never blocks an SSR page's own scripts/styles/images/fetches, it only
+  * locks down the `base` element, framing (mirroring the `SAMEORIGIN`
+  * X-Frame-Options default), and legacy plugins. Pass a string to apply that
+  * exact policy to every response (HTML included); `false` to never send one.
   */
   csp?: string | false;
   /** `X-Frame-Options` (clickjacking). Defaults to `SAMEORIGIN`. `false` omits it. */
@@ -1201,7 +1271,7 @@ interface SecurityOptions {
 interface ResolvedHeaders {
   coop: string | undefined;
   csp: {
-    htmlToo: boolean;
+    htmlValue: string | undefined;
     value: string;
   } | undefined;
   enabled: boolean;
@@ -1264,6 +1334,24 @@ declare const resolveSecurity: (security: SecurityOptions | undefined, env?: Rec
 * @returns a `403` Response when the origin is untrusted, or `undefined` when the request is allowed.
 */
 declare const enforceOrigin: (request: Request, resolved: ResolvedSecurity) => Response | undefined;
+/**
+* CSRF defense for the WebSocket upgrade (Cross-Site WebSocket Hijacking).
+*
+* A WS handshake is an HTTP `GET`, so {@link enforceOrigin}'s safe-method
+* exemption never fires for it — yet the browser auto-attaches the session
+* cookie to the handshake and WebSocket connections are NOT governed by
+* CORS/SOP. Without an explicit `Origin` check any page can open
+* `wss://app/_lunora/ws`, authenticate as the logged-in victim, and read the
+* victim's live queries + issue mutations as them. This guard closes that hole.
+*
+* Scoped to cookie-bearing upgrades — the only vector CSWSH can ride (a browser
+* attaches cookies but never a bearer token). Bearer/token/server-to-server
+* upgrades (no `Cookie`) are exempt. A browser ALWAYS sends `Origin` on a WS
+* handshake, so a missing/untrusted `Origin` on a cookie-bearing upgrade fails
+* closed (mirrors {@link enforceOrigin}).
+* @returns a `403` Response when the upgrade origin is untrusted, or `undefined` when it is allowed.
+*/
+
 /**
 * Answer a CORS preflight (`OPTIONS` carrying `Access-Control-Request-Method`)
 * for an allowlisted origin with a `204`. Returns `undefined` for non-preflight
@@ -1718,17 +1806,21 @@ interface WorkerOptions {
   */
   adminToken?: string;
   /**
-  * Acknowledge — explicitly — that sharded and fan-out access may be
-  * exercised by any caller (including unauthenticated ones) because no
-  * authorization callback is configured. When neither {@link WorkerOptions.authorizeShard}
-  * nor {@link WorkerOptions.authorizeFanOut} is set, naming a non-default shard or sending
-  * a fan-out envelope is authorization-open: this is the historical posture,
-  * preserved for backward compatibility. The runtime emits a single loud
-  * `console.warn` the first time such a request is seen so the gap is
-  * visible in logs. Set this to `true` to assert the posture is intentional
-  * and silence that warning. It does NOT change behaviour — it is purely an
-  * acknowledgement flag — and has no effect once an `authorize*` callback is
-  * configured.
+  * Opt into an authorization-open posture for sharded and fan-out access.
+  *
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
+  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
+  * is configured, naming a non-default shard (a potential cross-tenant hop)
+  * or sending a fan-out envelope is rejected with a `403`
+  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
+  * requests from any caller (including unauthenticated ones) — appropriate
+  * only when every table is protected by per-row RLS. The runtime then emits
+  * a single `console.warn` so the open posture stays visible in logs. Has no
+  * effect once an `authorize*` callback is configured (those gate directly).
+  *
+  * NOTE: this is a behaviour change from earlier alphas, where the same
+  * situation was warn-once-then-allow. Apps that relied on client-chosen
+  * shard keys without an `authorize*` callback must set this flag explicitly.
   */
   allowUnauthenticatedShardAccess?: boolean;
   /**
@@ -1932,6 +2024,14 @@ interface WorkerOptions {
   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
+  * Introspector for Workers KV namespaces, backing the studio's KV browser
+  * via `GET /_lunora/admin/kv/namespaces`, `GET /_lunora/admin/kv/keys`,
+  * `GET|PUT|DELETE /_lunora/admin/kv/value`. Build it from the env's bound
+  * KV namespaces with `createKvIntrospector` from `@lunora/bindings/kv`.
+  * Omit it and those endpoints respond `KV_NOT_CONFIGURED`.
+  */
+  kvIntrospector?: KvIntrospector;
+  /**
   * Optional telemetry sink. When supplied, the worker emits one
   * `onRpc` event per dispatched RPC (single-shard forward or fan-out)
   * with duration / ok / error / shardKey or fanOut metadata. Sink
@@ -2515,4 +2615,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BOB2YZ6v.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BUf56-tZ.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
@@ -7,7 +7,7 @@ export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK
 export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-ZeZYUPNu.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DbISh_Wi.mjs';
+export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-HRXo-oOD.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-YjvUKisc.mjs';
 

package/dist/packem_shared/{composeWorker-BOB2YZ6v.mjs → composeWorker-BUf56-tZ.mjs}

@@ -4,7 +4,7 @@ import { wrapResolverWithContract } from './composeIdentityResolvers-YjvUKisc.mj
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-YjvUKisc.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-HRXo-oOD.mjs';
 
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
@@ -250,15 +250,15 @@ const buildAuthAdminRoutes = (deps) => {
       }
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
-      const message = typeof candidate.message === "string" ? candidate.message : "auth admin operation failed";
-      throw new LunoraError(message, { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      console.error("[lunora] auth admin operation failed:", error);
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
     }
   };
   const handle = async (request, descriptor) => {
+    deps.assertAdmin(request);
     if (request.method !== descriptor.http) {
       throw new LunoraError(`Auth admin endpoint requires ${descriptor.http}`, { code: "METHOD_NOT_ALLOWED", status: 405 });
     }
-    deps.assertAdmin(request);
     const admin = deps.getAuthAdmin();
     if (admin === void 0) {
       throw new LunoraError("auth endpoints require an `authAdmin` on the worker", { code: "AUTH_NOT_CONFIGURED", status: 400 });
@@ -380,9 +380,9 @@ const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   }
   return out.buffer;
 };
-const readJsonBodyWithLimit = async (request) => {
+const readJsonBodyWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   try {
-    const text = await readBodyTextWithLimit(request);
+    const text = await readBodyTextWithLimit(request, limit);
     return text === "" ? {} : JSON.parse(text);
   } catch (error) {
     if (error instanceof LunoraError) {
@@ -1011,6 +1011,128 @@ const buildIntrospectionAdminRoutes = (deps) => {
   };
 };
 
+const KV_NAMESPACES_PATH = "/_lunora/admin/kv/namespaces";
+const KV_KEYS_PATH = "/_lunora/admin/kv/keys";
+const KV_VALUE_PATH = "/_lunora/admin/kv/value";
+const KV_VALUE_MAX_BODY_BYTES = 32 * 1048576;
+const KV_MIN_EXPIRATION_SECONDS = 60;
+const buildKvAdminRoutes = (deps) => {
+  const { readJsonBody, requireAdminOption } = deps;
+  const gate = (request) => requireAdminOption(request, deps.kvIntrospector, {
+    code: "KV_NOT_CONFIGURED",
+    message: "KV endpoints require a `kvIntrospector` on the worker"
+  });
+  const ok = (payload) => Response.json(payload, { headers: { "content-type": "application/json" }, status: 200 });
+  const requireNamespaceAndKey = (request, verb) => {
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    const key = url.searchParams.get("key") ?? "";
+    if (namespace === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`namespace\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    if (key === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`key\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    return { key, namespace };
+  };
+  const requireKnownNamespace = async (introspector, namespace) => {
+    const namespaces = await introspector.listNamespaces();
+    if (!namespaces.some((entry) => entry.binding === namespace)) {
+      throw new LunoraError(`Unknown KV namespace binding \`${namespace}\``, { code: "NOT_FOUND", status: 404 });
+    }
+  };
+  const handleKvNamespaces = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-namespaces endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return ok({ namespaces: await gate(request).listNamespaces() });
+  };
+  const handleKvKeys = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-keys endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = gate(request);
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    if (namespace === "") {
+      throw new LunoraError("KV-keys request requires a `namespace` query parameter", { code: "BAD_REQUEST", status: 400 });
+    }
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const cursor = url.searchParams.get("cursor") ?? void 0;
+    const limitRaw = url.searchParams.get("limit");
+    const parsedLimit = limitRaw === null ? void 0 : Number.parseInt(limitRaw, 10);
+    if (parsedLimit !== void 0 && (!Number.isInteger(parsedLimit) || parsedLimit < 1)) {
+      throw new LunoraError("KV-keys `limit` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    const limit = parsedLimit === void 0 ? void 0 : Math.min(parsedLimit, 1e3);
+    await requireKnownNamespace(introspector, namespace);
+    return ok(await introspector.listKeys({ cursor, limit, namespace, prefix }));
+  };
+  const handleKvValueGet = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "GET");
+    await requireKnownNamespace(introspector, params.namespace);
+    return ok(await introspector.getValue(params));
+  };
+  const handleKvValuePut = async (request) => {
+    const introspector = gate(request);
+    const candidate = await readJsonBody(request, KV_VALUE_MAX_BODY_BYTES);
+    if (typeof candidate.namespace !== "string" || candidate.namespace === "") {
+      throw new LunoraError("KV-value PUT request requires a `namespace` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.key !== "string" || candidate.key === "") {
+      throw new LunoraError("KV-value PUT request requires a `key` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.value !== "string") {
+      throw new LunoraError("KV-value PUT request requires a `value` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (candidate.expirationTtl !== void 0 && (typeof candidate.expirationTtl !== "number" || !Number.isInteger(candidate.expirationTtl) || candidate.expirationTtl < KV_MIN_EXPIRATION_SECONDS)) {
+      throw new LunoraError("KV-value PUT `expirationTtl` must be an integer ≥ 60", { code: "BAD_REQUEST", status: 400 });
+    }
+    const minExpiration = Math.floor(Date.now() / 1e3) + KV_MIN_EXPIRATION_SECONDS;
+    if (candidate.expiration !== void 0 && (typeof candidate.expiration !== "number" || !Number.isInteger(candidate.expiration) || candidate.expiration < minExpiration)) {
+      throw new LunoraError("KV-value PUT `expiration` must be a Unix-seconds timestamp at least 60 seconds in the future", {
+        code: "BAD_REQUEST",
+        status: 400
+      });
+    }
+    await requireKnownNamespace(introspector, candidate.namespace);
+    await introspector.putValue({
+      expiration: candidate.expiration,
+      expirationTtl: candidate.expirationTtl,
+      key: candidate.key,
+      metadata: candidate.metadata,
+      namespace: candidate.namespace,
+      value: candidate.value
+    });
+    return ok({ ok: true });
+  };
+  const handleKvValueDelete = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "DELETE");
+    await requireKnownNamespace(introspector, params.namespace);
+    await introspector.deleteKey(params);
+    return ok({ deleted: true });
+  };
+  const kvValueHandlers = {
+    DELETE: handleKvValueDelete,
+    GET: handleKvValueGet,
+    PUT: handleKvValuePut
+  };
+  const handleKvValue = (request) => {
+    const handler = kvValueHandlers[request.method];
+    if (!handler) {
+      throw new LunoraError("KV-value endpoint requires GET, PUT, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return handler(request);
+  };
+  return {
+    [KV_NAMESPACES_PATH]: handleKvNamespaces,
+    [KV_KEYS_PATH]: handleKvKeys,
+    [KV_VALUE_PATH]: handleKvValue
+  };
+};
+
 const MIGRATE_PATH$1 = "/_lunora/migrate";
 const PITR_PATH = "/_lunora/admin/pitr";
 const RANK_PATH = "/_lunora/admin/rank";
@@ -1744,9 +1866,18 @@ const parseEnvelope = async (request) => {
     throw new LunoraError("RPC `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
   }
   const envelope = body;
+  const fanOut = validateFanOut(envelope.fanOut);
+  const args = envelope.args ?? {};
+  if (fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
+    const requestedTable = args.table;
+    if (typeof requestedTable === "string" && requestedTable !== fanOut.table) {
+      throw new LunoraError("RPC `args.table` must match the authorized `fanOut.table` for a relation fan-out", { code: "BAD_REQUEST", status: 400 });
+    }
+    args.table = fanOut.table;
+  }
   return {
-    args: envelope.args ?? {},
-    fanOut: validateFanOut(envelope.fanOut),
+    args,
+    fanOut,
     functionPath: envelope.functionPath,
     shardKey: envelope.shardKey
   };
@@ -1864,18 +1995,24 @@ const createWorker = (options) => {
     }
     return context;
   };
-  const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
   let warnedUnauthenticatedShardAccess = false;
-  const warnUnauthenticatedShardAccessOnce = (kind) => {
-    if (hasAnyShardAuth || options.allowUnauthenticatedShardAccess || warnedUnauthenticatedShardAccess) {
+  const guardUnauthenticatedShardAccess = (kind) => {
+    if (!options.allowUnauthenticatedShardAccess) {
+      const callback = kind === "fan-out" ? "authorizeFanOut" : "authorizeShard";
+      throw new LunoraError(
+        `${kind} access is default-denied: configure \`${callback}\` on the worker, or set \`allowUnauthenticatedShardAccess: true\` to explicitly allow unauthenticated ${kind} access (relying solely on per-row RLS).`,
+        { code: kind === "fan-out" ? "FORBIDDEN_FANOUT" : "FORBIDDEN_SHARD", status: 403 }
+      );
+    }
+    if (warnedUnauthenticatedShardAccess) {
       return;
     }
     warnedUnauthenticatedShardAccess = true;
     console.warn(
       [
-        `[lunora] SECURITY: received ${kind} access but neither \`authorizeShard\` nor \`authorizeFanOut\` is configured — `,
+        `[lunora] SECURITY: serving ${kind} access with \`allowUnauthenticatedShardAccess: true\` and no \`authorizeShard\`/\`authorizeFanOut\` — `,
         `any caller (including unauthenticated ones) can target any shard / fan out across the table. `,
-        `Configure \`authorizeShard\`/\`authorizeFanOut\`, or set \`allowUnauthenticatedShardAccess: true\` to acknowledge this posture and silence this warning.`
+        `This is safe only if every table is protected by per-row RLS. Configure \`authorizeShard\`/\`authorizeFanOut\` to gate it.`
       ].join("")
     );
   };
@@ -1887,20 +2024,20 @@ const createWorker = (options) => {
     resolveForwardContext: resolveAdminForwardContext,
     shardDO
   });
-  const dispatchToShard = async (functionPath, args, shardKey) => {
+  const dispatchToShard = async (functionPath, args, shardKey, mutationId) => {
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(null, shardKey);
       if (!allowed) {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     }
+    const headers = { "content-type": "application/json", "x-lunora-system": "1" };
+    if (mutationId !== void 0 && mutationId.length > 0) {
+      headers["x-lunora-mutation-id"] = mutationId;
+    }
     const forwarded = new Request("https://shard.internal/rpc", {
-      // `x-lunora-system` marks this as a trusted server-initiated dispatch
-      // so the shard may run `internal` functions (scheduled/cron jobs are
-      // typically internal). Authorization was already enforced above; this
-      // header is set only here, never on the client RPC path.
       body: JSON.stringify({ args, functionPath }),
-      headers: { "content-type": "application/json", "x-lunora-system": "1" },
+      headers,
       method: "POST"
     });
     return forwardToShard(shardDO, shardKey, forwarded);
@@ -2016,7 +2153,8 @@ const createWorker = (options) => {
     }
     const args = candidate.args ?? {};
     const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
-    const response = await dispatchToShard(candidate.functionPath, args, shardKey);
+    const mutationId = typeof candidate.id === "string" && candidate.id.length > 0 ? candidate.id : void 0;
+    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId);
     await releasePoolSlot(candidate);
     return response;
   };
@@ -2097,6 +2235,11 @@ const createWorker = (options) => {
     requireAdminOption,
     vectorIntrospector: options.vectorIntrospector
   });
+  const kvAdminRoutes = buildKvAdminRoutes({
+    kvIntrospector: options.kvIntrospector,
+    readJsonBody: readJsonBodyWithLimit,
+    requireAdminOption
+  });
   const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
     assertAdmin: assertAdminAuthorized,
     options: {
@@ -2159,6 +2302,10 @@ const createWorker = (options) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
+    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
+    if (blockedUpgrade) {
+      return blockedUpgrade;
+    }
     const shardKey = url.searchParams.get("shard") ?? defaultShard;
     const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     if (options.authorizeShard) {
@@ -2167,7 +2314,7 @@ const createWorker = (options) => {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
     }
     const upgradeHeaders = new Headers(request.headers);
     upgradeHeaders.delete("x-lunora-userid");
@@ -2196,29 +2343,34 @@ const createWorker = (options) => {
     }
     return forwardToShard(shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
   };
+  const authorizeFanOutEnvelope = async (fanOut, functionPath, identity) => {
+    if (options.authorizeFanOut) {
+      const allowed = await options.authorizeFanOut(identity, fanOut.table, functionPath);
+      if (!allowed) {
+        throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
+      }
+      return;
+    }
+    if (functionPath.startsWith("__lunora_relation__:")) {
+      throw new LunoraError("reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    if (options.authorizeShard) {
+      throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    guardUnauthenticatedShardAccess("fan-out");
+  };
   const authorizeRpcEnvelope = async (envelope, identity) => {
+    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_admin__:")) {
+      return;
+    }
     if (envelope.fanOut) {
-      if (options.authorizeFanOut) {
-        const allowed = await options.authorizeFanOut(identity, envelope.fanOut.table, envelope.functionPath);
-        if (!allowed) {
-          throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
-        }
-      } else if (envelope.functionPath.startsWith("__lunora_relation__:")) {
-        throw new LunoraError(
-          "reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker",
-          {
-            code: "FORBIDDEN_FANOUT",
-            status: 403
-          }
-        );
-      } else if (options.authorizeShard) {
-        throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
-          code: "FORBIDDEN_FANOUT",
-          status: 403
-        });
-      } else {
-        warnUnauthenticatedShardAccessOnce("fan-out");
-      }
+      await authorizeFanOutEnvelope(envelope.fanOut, envelope.functionPath, identity);
       return;
     }
     if (options.authorizeShard) {
@@ -2228,7 +2380,7 @@ const createWorker = (options) => {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (envelope.shardKey !== void 0 && envelope.shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
     }
   };
   const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
@@ -2631,6 +2783,7 @@ const createWorker = (options) => {
     ...workflowsAdminRoutes,
     ...storageAdminRoutes,
     ...vectorAdminRoutes,
+    ...kvAdminRoutes,
     ...introspectionAdminRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.

package/dist/packem_shared/{decorateResponse-DbISh_Wi.mjs → decorateResponse-HRXo-oOD.mjs}

@@ -1,4 +1,13 @@
 const DEFAULT_CSP = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+const htmlCspFor = (frameOptions) => {
+  const parts = ["base-uri 'none'", "object-src 'none'"];
+  if (frameOptions === "DENY") {
+    parts.push("frame-ancestors 'none'");
+  } else if (frameOptions === "SAMEORIGIN") {
+    parts.push("frame-ancestors 'self'");
+  }
+  return parts.join("; ");
+};
 const DEFAULT_PERMISSIONS_POLICY = "accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()";
 const DEFAULT_CORS_HEADERS = ["Authorization", "Content-Type", "X-D1-Bookmark", "X-Lunora-Mutation-Id"];
 const DEFAULT_CORS_METHODS = ["DELETE", "GET", "HEAD", "PATCH", "POST", "PUT"];
@@ -13,14 +22,14 @@ const resolveHstsHeader = (hsts) => {
   const includeSubDomains = config.includeSubDomains ?? true;
   return `max-age=${String(maxAge)}${includeSubDomains ? "; includeSubDomains" : ""}${config.preload ? "; preload" : ""}`;
 };
-const resolveCspHeader = (csp) => {
+const resolveCspHeader = (csp, htmlDefault) => {
   if (csp === false) {
     return void 0;
   }
   if (typeof csp === "string") {
-    return { htmlToo: true, value: csp };
+    return { htmlValue: csp, value: csp };
   }
-  return { htmlToo: false, value: DEFAULT_CSP };
+  return { htmlValue: htmlDefault, value: DEFAULT_CSP };
 };
 const resolveHeaders = (input) => {
   if (input === false) {
@@ -35,11 +44,12 @@ const resolveHeaders = (input) => {
     };
   }
   const options = input === void 0 || input === true ? {} : input;
+  const frameOptions = options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN";
   return {
     coop: "same-origin",
-    csp: resolveCspHeader(options.csp),
+    csp: resolveCspHeader(options.csp, htmlCspFor(frameOptions)),
     enabled: true,
-    frameOptions: options.frameOptions === false ? void 0 : options.frameOptions ?? "SAMEORIGIN",
+    frameOptions,
     hsts: resolveHstsHeader(options.hsts),
     permissionsPolicy: options.permissionsPolicy === false ? void 0 : options.permissionsPolicy ?? DEFAULT_PERMISSIONS_POLICY,
     referrerPolicy: options.referrerPolicy === false ? void 0 : options.referrerPolicy ?? "strict-origin-when-cross-origin"
@@ -65,6 +75,11 @@ const resolveCors = (input) => {
   if (typeof origins === "function") {
     isAllowed = origins;
     isExplicitlyAllowed = origins;
+    if (allowCredentials) {
+      console.warn(
+        "@lunora/runtime: security.cors combines a custom `allowedOrigins` predicate with `allowCredentials: true`. Ensure the predicate matches ONLY trusted origins by exact equality — an over-broad predicate (e.g. `() => true`, or `endsWith`/`includes` checks) reflects any origin with credentials, defeating the allowlist and the CSRF guard."
+      );
+    }
   } else {
     const originsList = origins;
     if (originsList.includes("*") && allowCredentials) {
@@ -152,6 +167,20 @@ const enforceOrigin = (request, resolved) => {
     { headers: { "content-type": "application/json" }, status: 403 }
   );
 };
+const enforceWebSocketOrigin = (request, resolved) => {
+  if (!resolved.csrf.enabled || !request.headers.get("cookie")) {
+    return void 0;
+  }
+  const selfOrigin = new URL(request.url).origin;
+  const source = originOf(request.headers.get("origin"));
+  if (source !== void 0 && isTrustedOrigin(source, selfOrigin, resolved)) {
+    return void 0;
+  }
+  return Response.json(
+    { error: { code: "FORBIDDEN_ORIGIN", message: "cross-origin websocket upgrade rejected" } },
+    { headers: { "content-type": "application/json" }, status: 403 }
+  );
+};
 const corsResponseHeaders = (origin, cors) => {
   const headers = new Headers();
   headers.set("access-control-allow-origin", origin);
@@ -199,8 +228,11 @@ const applyBaselineHeaders = (headers, request, response, config) => {
   if (config.coop !== void 0) {
     setIfAbsent(headers, "cross-origin-opener-policy", config.coop);
   }
-  if (config.csp !== void 0 && (config.csp.htmlToo || !isHtmlResponse(response))) {
-    setIfAbsent(headers, "content-security-policy", config.csp.value);
+  if (config.csp !== void 0) {
+    const cspValue = isHtmlResponse(response) ? config.csp.htmlValue : config.csp.value;
+    if (cspValue !== void 0) {
+      setIfAbsent(headers, "content-security-policy", cspValue);
+    }
   }
 };
 const applyCorsHeaders = (headers, request, cors) => {
@@ -230,4 +262,4 @@ const decorateResponse = (response, request, resolved) => {
   return new Response(response.body, { headers, status: response.status, statusText: response.statusText });
 };
 
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity };
+export { decorateResponse, enforceOrigin, enforceWebSocketOrigin, handleCorsPreflight, resolveSecurity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.13",
+  "version": "1.0.0-alpha.15",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",