@lunora/runtime 1.0.0-alpha.14 → 1.0.0-alpha.16

package/dist/index.d.mts

@@ -446,6 +446,72 @@ interface IdentityContractLike {
 * the wrapped resolver; the admin path keeps the raw one (admin is gated by the
 * bearer / Access, not the app's identity contract).
 */
+/** One KV namespace as the studio's KV browser surfaces it. */
+interface KvNamespaceSummary {
+  /** The wrangler/env binding name, e.g. `"MY_KV"`. */
+  binding: string;
+}
+/** One key entry as the KV admin browser surfaces it. */
+interface KvKeyEntry {
+  /** Absolute expiration (Unix seconds), when set. */
+  expiration?: number;
+  /** Per-key metadata set at write time, or absent when none. */
+  metadata?: unknown;
+  /** The key name. */
+  name: string;
+}
+/** A paginated page of KV keys as the admin browser returns it. */
+interface KvKeyListResult {
+  /** Opaque cursor for the next page; absent when the listing is complete. */
+  cursor?: string;
+  /** The keys on this page. */
+  keys: KvKeyEntry[];
+  /** True when this is the final page. */
+  listComplete: boolean;
+}
+/** A KV value together with its stored metadata. */
+interface KvValueResult {
+  /** Per-key metadata, or `null` when none. */
+  metadata: unknown;
+  /** The stored value as a string, or `null` when the key is absent. */
+  value: null | string;
+}
+/**
+* The introspector the worker wires for the studio's KV browser. Build it from
+* the env's bound KV namespaces. Omit it and the `/_lunora/admin/kv/*`
+* endpoints respond `KV_NOT_CONFIGURED`.
+*/
+interface KvIntrospector {
+  /** Delete a key from a namespace. No-op when the key is absent. */
+  deleteKey: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<void>;
+  /** Read a value (as text) and its metadata from a namespace key. */
+  getValue: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<KvValueResult>;
+  /** List keys in a namespace, optionally filtered by prefix and paginated. */
+  listKeys: (options: {
+    cursor?: string;
+    limit?: number;
+    namespace: string;
+    prefix?: string;
+  }) => Promise<KvKeyListResult>;
+  /** List the registered KV namespaces (binding names). */
+  listNamespaces: () => Promise<KvNamespaceSummary[]>;
+  /** Write a value (as text) with optional absolute expiration / relative TTL and metadata. */
+  putValue: (options: {
+    expiration?: number;
+    expirationTtl?: number;
+    key: string;
+    metadata?: unknown;
+    namespace: string;
+    value: string;
+  }) => Promise<void>;
+}
+/** The worker internals the KV routes reach through injection rather than closure. */
 /**
 * Observability hooks for the Lunora runtime.
 *
@@ -1742,15 +1808,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen
@@ -1958,6 +2028,14 @@ interface WorkerOptions {
   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
+  * Introspector for Workers KV namespaces, backing the studio's KV browser
+  * via `GET /_lunora/admin/kv/namespaces`, `GET /_lunora/admin/kv/keys`,
+  * `GET|PUT|DELETE /_lunora/admin/kv/value`. Build it from the env's bound
+  * KV namespaces with `createKvIntrospector` from `@lunora/bindings/kv`.
+  * Omit it and those endpoints respond `KV_NOT_CONFIGURED`.
+  */
+  kvIntrospector?: KvIntrospector;
+  /**
   * Optional telemetry sink. When supplied, the worker emits one
   * `onRpc` event per dispatched RPC (single-shard forward or fan-out)
   * with duration / ok / error / shardKey or fanOut metadata. Sink
@@ -2541,4 +2619,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -446,6 +446,72 @@ interface IdentityContractLike {
 * the wrapped resolver; the admin path keeps the raw one (admin is gated by the
 * bearer / Access, not the app's identity contract).
 */
+/** One KV namespace as the studio's KV browser surfaces it. */
+interface KvNamespaceSummary {
+  /** The wrangler/env binding name, e.g. `"MY_KV"`. */
+  binding: string;
+}
+/** One key entry as the KV admin browser surfaces it. */
+interface KvKeyEntry {
+  /** Absolute expiration (Unix seconds), when set. */
+  expiration?: number;
+  /** Per-key metadata set at write time, or absent when none. */
+  metadata?: unknown;
+  /** The key name. */
+  name: string;
+}
+/** A paginated page of KV keys as the admin browser returns it. */
+interface KvKeyListResult {
+  /** Opaque cursor for the next page; absent when the listing is complete. */
+  cursor?: string;
+  /** The keys on this page. */
+  keys: KvKeyEntry[];
+  /** True when this is the final page. */
+  listComplete: boolean;
+}
+/** A KV value together with its stored metadata. */
+interface KvValueResult {
+  /** Per-key metadata, or `null` when none. */
+  metadata: unknown;
+  /** The stored value as a string, or `null` when the key is absent. */
+  value: null | string;
+}
+/**
+* The introspector the worker wires for the studio's KV browser. Build it from
+* the env's bound KV namespaces. Omit it and the `/_lunora/admin/kv/*`
+* endpoints respond `KV_NOT_CONFIGURED`.
+*/
+interface KvIntrospector {
+  /** Delete a key from a namespace. No-op when the key is absent. */
+  deleteKey: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<void>;
+  /** Read a value (as text) and its metadata from a namespace key. */
+  getValue: (options: {
+    key: string;
+    namespace: string;
+  }) => Promise<KvValueResult>;
+  /** List keys in a namespace, optionally filtered by prefix and paginated. */
+  listKeys: (options: {
+    cursor?: string;
+    limit?: number;
+    namespace: string;
+    prefix?: string;
+  }) => Promise<KvKeyListResult>;
+  /** List the registered KV namespaces (binding names). */
+  listNamespaces: () => Promise<KvNamespaceSummary[]>;
+  /** Write a value (as text) with optional absolute expiration / relative TTL and metadata. */
+  putValue: (options: {
+    expiration?: number;
+    expirationTtl?: number;
+    key: string;
+    metadata?: unknown;
+    namespace: string;
+    value: string;
+  }) => Promise<void>;
+}
+/** The worker internals the KV routes reach through injection rather than closure. */
 /**
 * Observability hooks for the Lunora runtime.
 *
@@ -1742,15 +1808,19 @@ interface WorkerOptions {
   /**
   * Opt into an authorization-open posture for sharded and fan-out access.
   *
-  * By default (this flag unset/`false`) the runtime FAILS CLOSED: when
-  * neither {@link WorkerOptions.authorizeShard} nor {@link WorkerOptions.authorizeFanOut}
-  * is configured, naming a non-default shard (a potential cross-tenant hop)
-  * or sending a fan-out envelope is rejected with a `403`
-  * (`FORBIDDEN_SHARD`/`FORBIDDEN_FANOUT`). Set this to `true` to allow such
-  * requests from any caller (including unauthenticated ones) — appropriate
-  * only when every table is protected by per-row RLS. The runtime then emits
-  * a single `console.warn` so the open posture stays visible in logs. Has no
-  * effect once an `authorize*` callback is configured (those gate directly).
+  * By default (this flag unset/`false`) the runtime FAILS CLOSED per
+  * operation: naming a non-default shard (a potential cross-tenant hop) is
+  * rejected with a `403` (`FORBIDDEN_SHARD`) unless
+  * {@link WorkerOptions.authorizeShard} is configured, and a fan-out
+  * envelope is rejected (`FORBIDDEN_FANOUT`) unless
+  * {@link WorkerOptions.authorizeFanOut} is. Set this to `true` to allow
+  * such requests from any caller (including unauthenticated ones) —
+  * appropriate only when every table is protected by per-row RLS. The
+  * runtime then emits a single `console.warn` so the open posture stays
+  * visible in logs. The flag is consulted per operation: it has no effect
+  * on an operation whose own `authorize*` callback is configured (that
+  * callback gates directly), but configuring only one of the two callbacks
+  * does NOT cover the other operation.
   *
   * NOTE: this is a behaviour change from earlier alphas, where the same
   * situation was warn-once-then-allow. Apps that relied on client-chosen
@@ -1958,6 +2028,14 @@ interface WorkerOptions {
   */
   jurisdiction?: DurableObjectJurisdiction;
   /**
+  * Introspector for Workers KV namespaces, backing the studio's KV browser
+  * via `GET /_lunora/admin/kv/namespaces`, `GET /_lunora/admin/kv/keys`,
+  * `GET|PUT|DELETE /_lunora/admin/kv/value`. Build it from the env's bound
+  * KV namespaces with `createKvIntrospector` from `@lunora/bindings/kv`.
+  * Omit it and those endpoints respond `KV_NOT_CONFIGURED`.
+  */
+  kvIntrospector?: KvIntrospector;
+  /**
   * Optional telemetry sink. When supplied, the worker emits one
   * `onRpc` event per dispatched RPC (single-shard forward or fan-out)
   * with duration / ok / error / shardKey or fanOut metadata. Sink
@@ -2541,4 +2619,4 @@ declare const analyticsEngineSink: (options: AnalyticsEngineSinkOptions) => Obse
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-M4mPqTJx.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-BnZf6iRH.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-C0KOf7er.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-ocax8v0n.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-CL0aOtpo.mjs';
@@ -7,7 +7,7 @@ export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK
 export { analyticsEngineSink, combineSinks, consoleSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DqEvrQs0.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-ZeZYUPNu.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
-export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-HRXo-oOD.mjs';
+export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-igd8FJqk.mjs';
 export { NOOP_EXECUTION_CONTEXT } from './packem_shared/NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './packem_shared/composeIdentityResolvers-YjvUKisc.mjs';
 

package/dist/packem_shared/{composeWorker-M4mPqTJx.mjs → composeWorker-BnZf6iRH.mjs}

@@ -4,7 +4,7 @@ import { wrapResolverWithContract } from './composeIdentityResolvers-YjvUKisc.mj
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-YjvUKisc.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-HRXo-oOD.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-igd8FJqk.mjs';
 
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
@@ -251,7 +251,7 @@ const buildAuthAdminRoutes = (deps) => {
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
       console.error("[lunora] auth admin operation failed:", error);
-      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
     }
   };
   const handle = async (request, descriptor) => {
@@ -380,9 +380,9 @@ const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   }
   return out.buffer;
 };
-const readJsonBodyWithLimit = async (request) => {
+const readJsonBodyWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   try {
-    const text = await readBodyTextWithLimit(request);
+    const text = await readBodyTextWithLimit(request, limit);
     return text === "" ? {} : JSON.parse(text);
   } catch (error) {
     if (error instanceof LunoraError) {
@@ -1011,6 +1011,128 @@ const buildIntrospectionAdminRoutes = (deps) => {
   };
 };
 
+const KV_NAMESPACES_PATH = "/_lunora/admin/kv/namespaces";
+const KV_KEYS_PATH = "/_lunora/admin/kv/keys";
+const KV_VALUE_PATH = "/_lunora/admin/kv/value";
+const KV_VALUE_MAX_BODY_BYTES = 32 * 1048576;
+const KV_MIN_EXPIRATION_SECONDS = 60;
+const buildKvAdminRoutes = (deps) => {
+  const { readJsonBody, requireAdminOption } = deps;
+  const gate = (request) => requireAdminOption(request, deps.kvIntrospector, {
+    code: "KV_NOT_CONFIGURED",
+    message: "KV endpoints require a `kvIntrospector` on the worker"
+  });
+  const ok = (payload) => Response.json(payload, { headers: { "content-type": "application/json" }, status: 200 });
+  const requireNamespaceAndKey = (request, verb) => {
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    const key = url.searchParams.get("key") ?? "";
+    if (namespace === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`namespace\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    if (key === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`key\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    return { key, namespace };
+  };
+  const requireKnownNamespace = async (introspector, namespace) => {
+    const namespaces = await introspector.listNamespaces();
+    if (!namespaces.some((entry) => entry.binding === namespace)) {
+      throw new LunoraError(`Unknown KV namespace binding \`${namespace}\``, { code: "NOT_FOUND", status: 404 });
+    }
+  };
+  const handleKvNamespaces = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-namespaces endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return ok({ namespaces: await gate(request).listNamespaces() });
+  };
+  const handleKvKeys = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-keys endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = gate(request);
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    if (namespace === "") {
+      throw new LunoraError("KV-keys request requires a `namespace` query parameter", { code: "BAD_REQUEST", status: 400 });
+    }
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const cursor = url.searchParams.get("cursor") ?? void 0;
+    const limitRaw = url.searchParams.get("limit");
+    const parsedLimit = limitRaw === null ? void 0 : Number.parseInt(limitRaw, 10);
+    if (parsedLimit !== void 0 && (!Number.isInteger(parsedLimit) || parsedLimit < 1)) {
+      throw new LunoraError("KV-keys `limit` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    const limit = parsedLimit === void 0 ? void 0 : Math.min(parsedLimit, 1e3);
+    await requireKnownNamespace(introspector, namespace);
+    return ok(await introspector.listKeys({ cursor, limit, namespace, prefix }));
+  };
+  const handleKvValueGet = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "GET");
+    await requireKnownNamespace(introspector, params.namespace);
+    return ok(await introspector.getValue(params));
+  };
+  const handleKvValuePut = async (request) => {
+    const introspector = gate(request);
+    const candidate = await readJsonBody(request, KV_VALUE_MAX_BODY_BYTES);
+    if (typeof candidate.namespace !== "string" || candidate.namespace === "") {
+      throw new LunoraError("KV-value PUT request requires a `namespace` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.key !== "string" || candidate.key === "") {
+      throw new LunoraError("KV-value PUT request requires a `key` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.value !== "string") {
+      throw new LunoraError("KV-value PUT request requires a `value` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (candidate.expirationTtl !== void 0 && (typeof candidate.expirationTtl !== "number" || !Number.isInteger(candidate.expirationTtl) || candidate.expirationTtl < KV_MIN_EXPIRATION_SECONDS)) {
+      throw new LunoraError("KV-value PUT `expirationTtl` must be an integer ≥ 60", { code: "BAD_REQUEST", status: 400 });
+    }
+    const minExpiration = Math.floor(Date.now() / 1e3) + KV_MIN_EXPIRATION_SECONDS;
+    if (candidate.expiration !== void 0 && (typeof candidate.expiration !== "number" || !Number.isInteger(candidate.expiration) || candidate.expiration < minExpiration)) {
+      throw new LunoraError("KV-value PUT `expiration` must be a Unix-seconds timestamp at least 60 seconds in the future", {
+        code: "BAD_REQUEST",
+        status: 400
+      });
+    }
+    await requireKnownNamespace(introspector, candidate.namespace);
+    await introspector.putValue({
+      expiration: candidate.expiration,
+      expirationTtl: candidate.expirationTtl,
+      key: candidate.key,
+      metadata: candidate.metadata,
+      namespace: candidate.namespace,
+      value: candidate.value
+    });
+    return ok({ ok: true });
+  };
+  const handleKvValueDelete = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "DELETE");
+    await requireKnownNamespace(introspector, params.namespace);
+    await introspector.deleteKey(params);
+    return ok({ deleted: true });
+  };
+  const kvValueHandlers = {
+    DELETE: handleKvValueDelete,
+    GET: handleKvValueGet,
+    PUT: handleKvValuePut
+  };
+  const handleKvValue = (request) => {
+    const handler = kvValueHandlers[request.method];
+    if (!handler) {
+      throw new LunoraError("KV-value endpoint requires GET, PUT, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return handler(request);
+  };
+  return {
+    [KV_NAMESPACES_PATH]: handleKvNamespaces,
+    [KV_KEYS_PATH]: handleKvKeys,
+    [KV_VALUE_PATH]: handleKvValue
+  };
+};
+
 const MIGRATE_PATH$1 = "/_lunora/migrate";
 const PITR_PATH = "/_lunora/admin/pitr";
 const RANK_PATH = "/_lunora/admin/rank";
@@ -2113,6 +2235,11 @@ const createWorker = (options) => {
     requireAdminOption,
     vectorIntrospector: options.vectorIntrospector
   });
+  const kvAdminRoutes = buildKvAdminRoutes({
+    kvIntrospector: options.kvIntrospector,
+    readJsonBody: readJsonBodyWithLimit,
+    requireAdminOption
+  });
   const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
     assertAdmin: assertAdminAuthorized,
     options: {
@@ -2656,6 +2783,7 @@ const createWorker = (options) => {
     ...workflowsAdminRoutes,
     ...storageAdminRoutes,
     ...vectorAdminRoutes,
+    ...kvAdminRoutes,
     ...introspectionAdminRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.

package/dist/packem_shared/{decorateResponse-HRXo-oOD.mjs → decorateResponse-igd8FJqk.mjs}

@@ -75,11 +75,10 @@ const resolveCors = (input) => {
   if (typeof origins === "function") {
     isAllowed = origins;
     isExplicitlyAllowed = origins;
-    if (allowCredentials) {
-      console.warn(
-        "@lunora/runtime: security.cors combines a custom `allowedOrigins` predicate with `allowCredentials: true`. Ensure the predicate matches ONLY trusted origins by exact equality — an over-broad predicate (e.g. `() => true`, or `endsWith`/`includes` checks) reflects any origin with credentials, defeating the allowlist and the CSRF guard."
-      );
-    }
+    const credentialsNote = allowCredentials ? " AND reflects matching origins with credentials (`allowCredentials: true`)" : "";
+    console.warn(
+      `@lunora/runtime: security.cors uses a custom \`allowedOrigins\` predicate. It is trusted by the CSRF and WebSocket origin checks${credentialsNote} — ensure it matches ONLY trusted origins by exact equality; an over-broad predicate (e.g. \`() => true\`, or \`endsWith\`/\`includes\` checks) defeats the allowlist.`
+    );
   } else {
     const originsList = origins;
     if (originsList.includes("*") && allowCredentials) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.14",
+  "version": "1.0.0-alpha.16",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",