@lunora/runtime 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/packem_shared/{composeWorker-BmfKl1ei.mjs → composeWorker-Dpw9d1s5.mjs}

@@ -1,10 +1,20 @@
-import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
+import { isLunoraError, toErrorBody } from '@lunora/errors';
+import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
+import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
+import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
-import { resolveShard } from './resolveShard-DDkzWtrU.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
+import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-CsZc49QC.mjs';
+
+const RELAY_NAME_INFIX = "::relay::";
+const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
 
 const AUTH_BASE = "/_lunora/admin/auth";
 const AUTH_ADMIN_ERROR_STATUS = {
+  INVITER_REQUIRED: 400,
+  ORG_SLUG_INVALID: 400,
+  ORG_SLUG_TAKEN: 409,
   PASSWORD_TOO_LONG: 400,
   PASSWORD_TOO_SHORT: 400,
   USER_ALREADY_EXISTS: 409,
@@ -34,6 +44,23 @@ const parseRoleInput = (value) => {
   return void 0;
 };
 const optionalBodyString = (body, field) => typeof body[field] === "string" ? body[field] : void 0;
+const optionalBodyObject = (body, field) => {
+  const value = body[field];
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+};
+const requirePermission = (body) => {
+  const value = body["permission"];
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new LunoraError("`permission` object is required", { code: "BAD_REQUEST", status: 400 });
+  }
+  const out = {};
+  for (const [resource, actions] of Object.entries(value)) {
+    if (Array.isArray(actions) && actions.every((action) => typeof action === "string")) {
+      out[resource] = actions;
+    }
+  }
+  return out;
+};
 const AUTH_ROUTES = {
   [`${AUTH_BASE}/capabilities`]: {
     build: () => {
@@ -100,6 +127,34 @@ const AUTH_ROUTES = {
     http: "GET",
     method: "listInvitations"
   },
+  [`${AUTH_BASE}/config`]: {
+    build: () => {
+      return {};
+    },
+    http: "GET",
+    method: "config"
+  },
+  [`${AUTH_BASE}/organizations/teams`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listTeams"
+  },
+  [`${AUTH_BASE}/organizations/teams/members`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, teamId: requireQuery$1(query, "teamId") };
+    },
+    http: "GET",
+    method: "listTeamMembers"
+  },
+  [`${AUTH_BASE}/organizations/roles`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listOrgRoles"
+  },
   // --- mutations (POST) -------------------------------------------------------
   [`${AUTH_BASE}/users/create`]: {
     build: ({ body }) => {
@@ -232,6 +287,137 @@ const AUTH_ROUTES = {
     http: "POST",
     method: "cancelInvitation",
     returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/create`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: requireBodyString(body, "name"),
+        ownerId: optionalBodyString(body, "ownerId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "createOrganization"
+  },
+  [`${AUTH_BASE}/organizations/update`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: optionalBodyString(body, "name"),
+        organizationId: requireBodyString(body, "organizationId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "updateOrganization"
+  },
+  [`${AUTH_BASE}/organizations/remove`]: {
+    build: ({ body }) => {
+      return { organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "deleteOrganization",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/members/add`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role"),
+        userId: requireBodyString(body, "userId")
+      };
+    },
+    http: "POST",
+    method: "addMember"
+  },
+  [`${AUTH_BASE}/organizations/members/invite`]: {
+    build: ({ body }) => {
+      return {
+        email: requireBodyString(body, "email"),
+        inviterId: optionalBodyString(body, "inviterId"),
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "inviteMember"
+  },
+  [`${AUTH_BASE}/organizations/members/role`]: {
+    build: ({ body }) => {
+      const role = parseRoleInput(body["role"]);
+      if (role === void 0 || typeof role === "string" && role.trim() === "") {
+        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
+      }
+      return { memberId: requireBodyString(body, "memberId"), role };
+    },
+    http: "POST",
+    method: "updateMemberRole"
+  },
+  [`${AUTH_BASE}/organizations/teams/create`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "createTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/update`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "updateTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/remove`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "removeTeam",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/add`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId"), userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "addTeamMember"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/remove`]: {
+    build: ({ body }) => {
+      return { teamMemberId: requireBodyString(body, "teamMemberId") };
+    },
+    http: "POST",
+    method: "removeTeamMember",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/roles/create`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        permission: requirePermission(body),
+        role: requireBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "createOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/update`]: {
+    build: ({ body }) => {
+      return { permission: requirePermission(body), roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "updateOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/remove`]: {
+    build: ({ body }) => {
+      return { roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "deleteOrgRole",
+    returns: "void"
   }
 };
 const buildAuthAdminRoutes = (deps) => {
@@ -244,15 +430,15 @@ const buildAuthAdminRoutes = (deps) => {
       }
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
-      const message = typeof candidate.message === "string" ? candidate.message : "auth admin operation failed";
-      throw new LunoraError(message, { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      console.error("[lunora] auth admin operation failed:", error);
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
     }
   };
   const handle = async (request, descriptor) => {
+    deps.assertAdmin(request);
     if (request.method !== descriptor.http) {
       throw new LunoraError(`Auth admin endpoint requires ${descriptor.http}`, { code: "METHOD_NOT_ALLOWED", status: 405 });
     }
-    deps.assertAdmin(request);
     const admin = deps.getAuthAdmin();
     if (admin === void 0) {
       throw new LunoraError("auth endpoints require an `authAdmin` on the worker", { code: "AUTH_NOT_CONFIGURED", status: 400 });
@@ -278,6 +464,45 @@ const buildAuthAdminRoutes = (deps) => {
   return routes;
 };
 
+const MAX_BATCH_ENTRIES = 500;
+
+const normalizeBatchCall = (raw, index, defaultShard) => {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new LunoraError("each batch call must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  const call = raw;
+  if (typeof call.functionPath !== "string") {
+    throw new LunoraError("each batch call needs a string `functionPath`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (call.functionPath.startsWith("__lunora_relation__:") || call.functionPath.startsWith("__lunora_admin__")) {
+    throw new LunoraError("reserved function path cannot be batched", { code: "FORBIDDEN", status: 403 });
+  }
+  return {
+    entry: {
+      args: call.args === void 0 ? {} : call.args,
+      clientId: typeof call.clientId === "string" ? call.clientId : void 0,
+      clientSeq: typeof call.clientSeq === "number" ? call.clientSeq : void 0,
+      functionPath: call.functionPath,
+      id: typeof call.id === "number" ? call.id : index,
+      mutationId: typeof call.mutationId === "string" ? call.mutationId : void 0
+    },
+    shardKey: typeof call.shardKey === "string" ? call.shardKey : defaultShard
+  };
+};
+const groupBatchCallsByShard = (calls, defaultShard) => {
+  if (calls.length > MAX_BATCH_ENTRIES) {
+    throw new LunoraError(`RPC batch exceeds the ${String(MAX_BATCH_ENTRIES)}-call limit`, { code: "BAD_REQUEST", status: 400 });
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const [index, raw] of calls.entries()) {
+    const { entry, shardKey } = normalizeBatchCall(raw, index, defaultShard);
+    const group = groups.get(shardKey) ?? [];
+    group.push(entry);
+    groups.set(shardKey, group);
+  }
+  return groups;
+};
+
 const MAX_BODY_BYTES = 1048576;
 const readBodyTextWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   if (!request.body) {
@@ -335,9 +560,9 @@ const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   }
   return out.buffer;
 };
-const readJsonBodyWithLimit = async (request) => {
+const readJsonBodyWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   try {
-    const text = await readBodyTextWithLimit(request);
+    const text = await readBodyTextWithLimit(request, limit);
     return text === "" ? {} : JSON.parse(text);
   } catch (error) {
     if (error instanceof LunoraError) {
@@ -597,14 +822,14 @@ const partitionExportTables = (options, tables) => {
   }
   return { globalTables, shardLocalTables };
 };
-const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow) => {
+const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace) => {
   if (tables !== void 0 && shardLocalTables.length === 0) {
     return;
   }
   const exportTables = tables === void 0 ? [] : shardLocalTables;
   const probeFallback = tables === void 0 ? collectKnownTables() : [];
   const probeTables = exportTables.length > 0 ? exportTables : probeFallback;
-  const result = await coordinator.orchestrateExport(options.shardDO, {
+  const result = await coordinator.orchestrateExport(namespace, {
     args: { tables: exportTables },
     headers: forwardedHeaders,
     tables: probeTables
@@ -618,9 +843,9 @@ const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tabl
     }
   }
 };
-const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow) => {
+const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow, namespace) => {
   const { globalTables, shardLocalTables } = partitionExportTables(options, tables);
-  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow);
+  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace);
   const exportGlobalsFunction = options.exportGlobals;
   const wantGlobals = tables === void 0 || globalTables.length > 0;
   if (wantGlobals && exportGlobalsFunction) {
@@ -740,7 +965,7 @@ const mergeImportResult = (totals, result) => {
   }
   totals.conflicts += result.conflicts;
 };
-const streamingImport = async (request, options, forwardedHeaders) => {
+const streamingImport = async (request, options, forwardedHeaders, namespace) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
   const { errors, globalRows, perShard } = await bucketImportStream(request, options, defaultShard);
   const totals = { conflicts: 0, errors, inserted: {} };
@@ -749,7 +974,7 @@ const streamingImport = async (request, options, forwardedHeaders) => {
     if (!coordinator) {
       throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
     }
-    const result = await coordinator.orchestrateImport(options.shardDO, {
+    const result = await coordinator.orchestrateImport(namespace, {
       batches: [...perShard.values()],
       headers: forwardedHeaders
     });
@@ -966,7 +1191,129 @@ const buildIntrospectionAdminRoutes = (deps) => {
   };
 };
 
-const MIGRATE_PATH = "/_lunora/migrate";
+const KV_NAMESPACES_PATH = "/_lunora/admin/kv/namespaces";
+const KV_KEYS_PATH = "/_lunora/admin/kv/keys";
+const KV_VALUE_PATH = "/_lunora/admin/kv/value";
+const KV_VALUE_MAX_BODY_BYTES = 32 * 1048576;
+const KV_MIN_EXPIRATION_SECONDS = 60;
+const buildKvAdminRoutes = (deps) => {
+  const { readJsonBody, requireAdminOption } = deps;
+  const gate = (request) => requireAdminOption(request, deps.kvIntrospector, {
+    code: "KV_NOT_CONFIGURED",
+    message: "KV endpoints require a `kvIntrospector` on the worker"
+  });
+  const ok = (payload) => Response.json(payload, { headers: { "content-type": "application/json" }, status: 200 });
+  const requireNamespaceAndKey = (request, verb) => {
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    const key = url.searchParams.get("key") ?? "";
+    if (namespace === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`namespace\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    if (key === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`key\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    return { key, namespace };
+  };
+  const requireKnownNamespace = async (introspector, namespace) => {
+    const namespaces = await introspector.listNamespaces();
+    if (!namespaces.some((entry) => entry.binding === namespace)) {
+      throw new LunoraError(`Unknown KV namespace binding \`${namespace}\``, { code: "NOT_FOUND", status: 404 });
+    }
+  };
+  const handleKvNamespaces = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-namespaces endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return ok({ namespaces: await gate(request).listNamespaces() });
+  };
+  const handleKvKeys = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-keys endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = gate(request);
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    if (namespace === "") {
+      throw new LunoraError("KV-keys request requires a `namespace` query parameter", { code: "BAD_REQUEST", status: 400 });
+    }
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const cursor = url.searchParams.get("cursor") ?? void 0;
+    const limitRaw = url.searchParams.get("limit");
+    const parsedLimit = limitRaw === null ? void 0 : Number.parseInt(limitRaw, 10);
+    if (parsedLimit !== void 0 && (!Number.isInteger(parsedLimit) || parsedLimit < 1)) {
+      throw new LunoraError("KV-keys `limit` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    const limit = parsedLimit === void 0 ? void 0 : Math.min(parsedLimit, 1e3);
+    await requireKnownNamespace(introspector, namespace);
+    return ok(await introspector.listKeys({ cursor, limit, namespace, prefix }));
+  };
+  const handleKvValueGet = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "GET");
+    await requireKnownNamespace(introspector, params.namespace);
+    return ok(await introspector.getValue(params));
+  };
+  const handleKvValuePut = async (request) => {
+    const introspector = gate(request);
+    const candidate = await readJsonBody(request, KV_VALUE_MAX_BODY_BYTES);
+    if (typeof candidate.namespace !== "string" || candidate.namespace === "") {
+      throw new LunoraError("KV-value PUT request requires a `namespace` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.key !== "string" || candidate.key === "") {
+      throw new LunoraError("KV-value PUT request requires a `key` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.value !== "string") {
+      throw new LunoraError("KV-value PUT request requires a `value` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (candidate.expirationTtl !== void 0 && (typeof candidate.expirationTtl !== "number" || !Number.isInteger(candidate.expirationTtl) || candidate.expirationTtl < KV_MIN_EXPIRATION_SECONDS)) {
+      throw new LunoraError("KV-value PUT `expirationTtl` must be an integer ≥ 60", { code: "BAD_REQUEST", status: 400 });
+    }
+    const minExpiration = Math.floor(Date.now() / 1e3) + KV_MIN_EXPIRATION_SECONDS;
+    if (candidate.expiration !== void 0 && (typeof candidate.expiration !== "number" || !Number.isInteger(candidate.expiration) || candidate.expiration < minExpiration)) {
+      throw new LunoraError("KV-value PUT `expiration` must be a Unix-seconds timestamp at least 60 seconds in the future", {
+        code: "BAD_REQUEST",
+        status: 400
+      });
+    }
+    await requireKnownNamespace(introspector, candidate.namespace);
+    await introspector.putValue({
+      expiration: candidate.expiration,
+      expirationTtl: candidate.expirationTtl,
+      key: candidate.key,
+      metadata: candidate.metadata,
+      namespace: candidate.namespace,
+      value: candidate.value
+    });
+    return ok({ ok: true });
+  };
+  const handleKvValueDelete = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "DELETE");
+    await requireKnownNamespace(introspector, params.namespace);
+    await introspector.deleteKey(params);
+    return ok({ deleted: true });
+  };
+  const kvValueHandlers = {
+    DELETE: handleKvValueDelete,
+    GET: handleKvValueGet,
+    PUT: handleKvValuePut
+  };
+  const handleKvValue = (request) => {
+    const handler = kvValueHandlers[request.method];
+    if (!handler) {
+      throw new LunoraError("KV-value endpoint requires GET, PUT, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return handler(request);
+  };
+  return {
+    [KV_NAMESPACES_PATH]: handleKvNamespaces,
+    [KV_KEYS_PATH]: handleKvKeys,
+    [KV_VALUE_PATH]: handleKvValue
+  };
+};
+
+const MIGRATE_PATH$1 = "/_lunora/migrate";
 const PITR_PATH = "/_lunora/admin/pitr";
 const RANK_PATH = "/_lunora/admin/rank";
 const RANKPAGE_PATH = "/_lunora/admin/rankpage";
@@ -1223,7 +1570,7 @@ const buildOrchestrationAdminRoutes = (deps) => {
     return forwardToShard(shardDO, pitr.shardKey ?? defaultShard, forwarded);
   };
   return {
-    [MIGRATE_PATH]: handleMigrate,
+    [MIGRATE_PATH$1]: handleMigrate,
     [PITR_PATH]: handlePitr,
     [RANK_PATH]: handleRank,
     [RANKPAGE_PATH]: handleRankPage,
@@ -1502,7 +1849,7 @@ const buildWorkflowsAdminRoutes = (deps) => {
     assertAdmin(request);
     const client = resolveWorkflowsClient(env);
     if (!client) {
-      return throwNotConfigured();
+      return Response.json({ configured: false, instances: [], page: 1, perPage: 0, totalCount: 0 });
     }
     const workflowName = requireQuery(url, "name");
     const status = toInstanceStatus(url.searchParams.get("status"));
@@ -1554,9 +1901,14 @@ const buildWorkflowsAdminRoutes = (deps) => {
 
 const NDJSON_ENCODER = new TextEncoder();
 const RPC_PATH = "/_lunora/rpc";
+const RPC_BATCH_PATH = "/_lunora/rpc-batch";
 const WS_PATH = "/_lunora/ws";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const ADMIN_PATH_PREFIX = "/_lunora/admin/";
+const MIGRATE_PATH = "/_lunora/migrate";
+const STATUS_PATH = "/_lunora/status";
+const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
@@ -1569,7 +1921,7 @@ const isAuthAttemptPath = (pathname, basePath) => {
   return AUTH_ATTEMPT_SEGMENTS.some((segment) => suffix === segment || suffix.startsWith(`${segment}/`));
 };
 const buildErrorEvent = (functionPath, durationMs, error, extra) => {
-  const mappable = error instanceof LunoraError || isStructuralLunoraError(error) || isStructuralConflictError(error);
+  const mappable = isLunoraError(error);
   const code = mappable ? error.code : "INTERNAL_SERVER_ERROR";
   const status = mappable ? error.status : 500;
   const message = error instanceof Error ? error.message : String(error);
@@ -1598,6 +1950,8 @@ const resolveForwardContext = async (request, env, resolveIdentity) => {
   const cookie = request.headers.get("cookie");
   const bookmark = request.headers.get("x-d1-bookmark");
   const mutationId = request.headers.get("x-lunora-mutation-id");
+  const clientId = request.headers.get("x-lunora-client-id");
+  const clientSeq = request.headers.get("x-lunora-client-seq");
   if (authorization) {
     headers["authorization"] = authorization;
   }
@@ -1610,6 +1964,12 @@ const resolveForwardContext = async (request, env, resolveIdentity) => {
   if (mutationId) {
     headers["x-lunora-mutation-id"] = mutationId;
   }
+  if (clientId) {
+    headers["x-lunora-client-id"] = clientId;
+  }
+  if (clientSeq) {
+    headers["x-lunora-client-seq"] = clientSeq;
+  }
   const clientIp = request.headers.get("cf-connecting-ip");
   if (clientIp) {
     headers["x-lunora-client-ip"] = clientIp;
@@ -1662,6 +2022,12 @@ const validateFanOut = (fanOut) => {
   }
   return spec;
 };
+const logRpcDebug = (env, envelope) => {
+  if (!env?.LUNORA_DEBUG_RPC) {
+    return;
+  }
+  console.warn(`[lunora:rpc] ${envelope.fanOut ? "fan-out" : `shard=${envelope.shardKey ?? "(root)"}`} ${envelope.functionPath}`);
+};
 const parseEnvelope = async (request) => {
   const text = await readBodyTextWithLimit(request);
   let body;
@@ -1681,9 +2047,18 @@ const parseEnvelope = async (request) => {
     throw new LunoraError("RPC `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
   }
   const envelope = body;
+  const fanOut = validateFanOut(envelope.fanOut);
+  const args = envelope.args ?? {};
+  if (fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
+    const requestedTable = args.table;
+    if (typeof requestedTable === "string" && requestedTable !== fanOut.table) {
+      throw new LunoraError("RPC `args.table` must match the authorized `fanOut.table` for a relation fan-out", { code: "BAD_REQUEST", status: 400 });
+    }
+    args.table = fanOut.table;
+  }
   return {
-    args: envelope.args ?? {},
-    fanOut: validateFanOut(envelope.fanOut),
+    args,
+    fanOut,
     functionPath: envelope.functionPath,
     shardKey: envelope.shardKey
   };
@@ -1692,6 +2067,41 @@ const forwardToShard = async (namespace, shardKey, request) => {
   const stub = resolveShard(namespace, shardKey);
   return stub.fetch(request);
 };
+const relayProbeCache = /* @__PURE__ */ new Map();
+const RELAY_PROBE_TTL_MS = 5e3;
+const probeRelayCount = async (namespace, shardKey) => {
+  const now = Date.now();
+  const cached = relayProbeCache.get(shardKey);
+  if (cached !== void 0 && cached.expiresMs > now) {
+    return cached.relayCount;
+  }
+  let relayCount = 0;
+  try {
+    const response = await resolveShard(namespace, shardKey).fetch(new Request("https://shard.internal/_lunora/route"));
+    if (response.ok) {
+      const body = await response.json();
+      const reported = body.relayCount;
+      if (typeof reported === "number" && reported > 0) {
+        relayCount = Math.floor(reported);
+      }
+    }
+  } catch {
+    relayCount = 0;
+  }
+  relayProbeCache.set(shardKey, { expiresMs: now + RELAY_PROBE_TTL_MS, relayCount });
+  return relayCount;
+};
+const resolveShardBindingName = (env, namespace) => {
+  if (env === null || typeof env !== "object") {
+    return void 0;
+  }
+  for (const [key, value] of Object.entries(env)) {
+    if (value === namespace) {
+      return key;
+    }
+  }
+  return void 0;
+};
 const constantTimeEqual = (expected, supplied) => {
   const max = Math.max(expected.length, supplied.length);
   let diff = expected.length ^ supplied.length;
@@ -1740,6 +2150,9 @@ const checkAdminWsToken = (request, expected) => {
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
+  const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
+  const shardDO = applyJurisdiction(options.shardDO, options.jurisdiction);
+  const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
   let envAdminToken;
   const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
   const resolveAdminTokenFromEnv = (env) => {
@@ -1751,46 +2164,64 @@ const createWorker = (options) => {
       envAdminToken = value;
     }
   };
-  const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
+  const accessAdminGrants = /* @__PURE__ */ new WeakSet();
+  const requestIsAdmin = (request) => checkAdminAuth(request, effectiveAdminToken()) || accessAdminGrants.has(request);
+  const resolveAdminForwardContext = async (request, env) => {
+    const context = await resolveForwardContext(request, env, options.resolveIdentity);
+    if (accessAdminGrants.has(request) && context.headers["authorization"] === void 0) {
+      const token = effectiveAdminToken();
+      if (token !== void 0) {
+        context.headers["authorization"] = `Bearer ${token}`;
+      }
+    }
+    return context;
+  };
   let warnedUnauthenticatedShardAccess = false;
-  const warnUnauthenticatedShardAccessOnce = (kind) => {
-    if (hasAnyShardAuth || options.allowUnauthenticatedShardAccess || warnedUnauthenticatedShardAccess) {
+  const guardUnauthenticatedShardAccess = (kind) => {
+    if (!options.allowUnauthenticatedShardAccess) {
+      const callback = kind === "fan-out" ? "authorizeFanOut" : "authorizeShard";
+      throw new LunoraError(
+        `${kind} access is default-denied: configure \`${callback}\` on the worker, or set \`allowUnauthenticatedShardAccess: true\` to explicitly allow unauthenticated ${kind} access (relying solely on per-row RLS).`,
+        { code: kind === "fan-out" ? "FORBIDDEN_FANOUT" : "FORBIDDEN_SHARD", status: 403 }
+      );
+    }
+    if (warnedUnauthenticatedShardAccess) {
       return;
     }
     warnedUnauthenticatedShardAccess = true;
     console.warn(
       [
-        `[lunora] SECURITY: received ${kind} access but neither \`authorizeShard\` nor \`authorizeFanOut\` is configured — `,
+        `[lunora] SECURITY: serving ${kind} access with \`allowUnauthenticatedShardAccess: true\` and no \`authorizeShard\`/\`authorizeFanOut\` — `,
         `any caller (including unauthenticated ones) can target any shard / fan out across the table. `,
-        `Configure \`authorizeShard\`/\`authorizeFanOut\`, or set \`allowUnauthenticatedShardAccess: true\` to acknowledge this posture and silence this warning.`
+        `This is safe only if every table is protected by per-row RLS. Configure \`authorizeShard\`/\`authorizeFanOut\` to gate it.`
       ].join("")
     );
   };
   const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
     defaultShard,
     forwardToShard,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
-    shardDO: options.shardDO
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO
   });
-  const dispatchToShard = async (functionPath, args, shardKey) => {
+  const dispatchToShard = async (functionPath, args, shardKey, mutationId) => {
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(null, shardKey);
       if (!allowed) {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     }
+    const headers = { "content-type": "application/json", "x-lunora-system": "1" };
+    if (mutationId !== void 0 && mutationId.length > 0) {
+      headers["x-lunora-mutation-id"] = mutationId;
+    }
     const forwarded = new Request("https://shard.internal/rpc", {
-      // `x-lunora-system` marks this as a trusted server-initiated dispatch
-      // so the shard may run `internal` functions (scheduled/cron jobs are
-      // typically internal). Authorization was already enforced above; this
-      // header is set only here, never on the client RPC path.
       body: JSON.stringify({ args, functionPath }),
-      headers: { "content-type": "application/json", "x-lunora-system": "1" },
+      headers,
       method: "POST"
     });
-    return forwardToShard(options.shardDO, shardKey, forwarded);
+    return forwardToShard(shardDO, shardKey, forwarded);
   };
   const startCronWorkflow = async (binding, job, env) => {
     const candidate = env?.[binding];
@@ -1835,7 +2266,7 @@ const createWorker = (options) => {
     }
   };
   const handleRunCronJob = async (request, env) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     if (request.method !== "POST") {
@@ -1858,12 +2289,12 @@ const createWorker = (options) => {
   };
   const releasePoolSlot = async (candidate) => {
     const pool = typeof candidate.pool === "string" && candidate.pool.length > 0 ? candidate.pool : void 0;
-    if (!pool || !options.schedulerDO || typeof candidate.id !== "string") {
+    if (!pool || !schedulerDO || typeof candidate.id !== "string") {
       return;
     }
     const instanceName = typeof candidate.instanceName === "string" && candidate.instanceName.length > 0 ? candidate.instanceName : "default";
     try {
-      await options.schedulerDO.get(options.schedulerDO.idFromName(instanceName)).fetch(
+      await schedulerDO.get(schedulerDO.idFromName(instanceName)).fetch(
         new Request("https://scheduler.internal/complete", {
           body: JSON.stringify({ id: candidate.id, pool }),
           headers: { "content-type": "application/json" },
@@ -1903,23 +2334,24 @@ const createWorker = (options) => {
     }
     const args = candidate.args ?? {};
     const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
-    const response = await dispatchToShard(candidate.functionPath, args, shardKey);
+    const mutationId = typeof candidate.id === "string" && candidate.id.length > 0 ? candidate.id : void 0;
+    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId);
     await releasePoolSlot(candidate);
     return response;
   };
   const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
     applyGlobals: options.applyGlobals,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     knownTables: () => collectKnownTables(),
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
-    shardDO: options.shardDO,
-    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow),
-    streamingImport: (request, headers) => streamingImport(request, options, headers),
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO,
+    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
+    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
     syncGlobals: options.syncGlobals
   });
   const assertAdminAuthorized = (request) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
   };
@@ -1946,17 +2378,17 @@ const createWorker = (options) => {
     };
   };
   const requireSchedulerNamespace = () => {
-    if (options.schedulerDO === void 0) {
+    if (schedulerDO === void 0) {
       throw new LunoraError("scheduled endpoints require a `schedulerDO` namespace on the worker", { code: "SCHEDULER_NOT_CONFIGURED", status: 400 });
     }
-    return options.schedulerDO;
+    return schedulerDO;
   };
   const resolveSchedulerStub = (request) => {
     assertAdminAuthorized(request);
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()) || checkAdminWsToken(request, effectiveAdminToken()),
+    checkWsAdmin: (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -1984,6 +2416,11 @@ const createWorker = (options) => {
     requireAdminOption,
     vectorIntrospector: options.vectorIntrospector
   });
+  const kvAdminRoutes = buildKvAdminRoutes({
+    kvIntrospector: options.kvIntrospector,
+    readJsonBody: readJsonBodyWithLimit,
+    requireAdminOption
+  });
   const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
     assertAdmin: assertAdminAuthorized,
     options: {
@@ -1997,8 +2434,8 @@ const createWorker = (options) => {
     queryParameter,
     requireAdminOption
   });
-  const buildHttpActionContext = async (request, env) => {
-    const { claims, headers, userId } = await resolveForwardContext(request, env, options.resolveIdentity);
+  const buildHttpActionContext = async (request, env, context) => {
+    const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
     const run = async (reference, args = {}) => {
       const functionPath = reference.__lunoraRef;
       if (typeof functionPath !== "string") {
@@ -2009,7 +2446,7 @@ const createWorker = (options) => {
         headers,
         method: "POST"
       });
-      const response = await forwardToShard(options.shardDO, defaultShard, forwarded);
+      const response = await forwardToShard(shardDO, defaultShard, forwarded);
       const payload = await response.json();
       if (payload.error) {
         throw new LunoraError(payload.error.message ?? "shard RPC failed", {
@@ -2024,6 +2461,7 @@ const createWorker = (options) => {
         getIdentity: () => Promise.resolve(claims),
         userId
       },
+      cache: context.cache,
       fetch: globalThis.fetch.bind(globalThis),
       runAction: run,
       runMutation: run,
@@ -2034,7 +2472,7 @@ const createWorker = (options) => {
     if (!options.httpRouter) {
       return void 0;
     }
-    const httpContext = await buildHttpActionContext(request, env);
+    const httpContext = await buildHttpActionContext(request, env, context);
     try {
       return await options.httpRouter.fetch(request, { ...env, __lunoraCtx: httpContext }, context);
     } catch (error) {
@@ -2046,15 +2484,19 @@ const createWorker = (options) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
+    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
+    if (blockedUpgrade) {
+      return blockedUpgrade;
+    }
     const shardKey = url.searchParams.get("shard") ?? defaultShard;
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(identity, shardKey);
       if (!allowed) {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
     }
     const upgradeHeaders = new Headers(request.headers);
     upgradeHeaders.delete("x-lunora-userid");
@@ -2072,31 +2514,45 @@ const createWorker = (options) => {
     if (forwardedExp !== void 0) {
       upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
     }
-    return forwardToShard(options.shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
+    const binding = resolveShardBindingName(env, options.shardDO);
+    if (binding !== void 0) {
+      upgradeHeaders.set("x-lunora-shard-binding", binding);
+      const relayCount = await probeRelayCount(shardDO, shardKey);
+      if (relayCount > 0) {
+        const target = relayName(shardKey, Math.floor(Math.random() * relayCount));
+        return forwardToShard(shardDO, target, new Request(request, { headers: upgradeHeaders }));
+      }
+    }
+    return forwardToShard(shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
+  };
+  const authorizeFanOutEnvelope = async (fanOut, functionPath, identity) => {
+    if (options.authorizeFanOut) {
+      const allowed = await options.authorizeFanOut(identity, fanOut.table, functionPath);
+      if (!allowed) {
+        throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
+      }
+      return;
+    }
+    if (functionPath.startsWith("__lunora_relation__:")) {
+      throw new LunoraError("reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    if (options.authorizeShard) {
+      throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    guardUnauthenticatedShardAccess("fan-out");
   };
   const authorizeRpcEnvelope = async (envelope, identity) => {
+    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_admin__:")) {
+      return;
+    }
     if (envelope.fanOut) {
-      if (options.authorizeFanOut) {
-        const allowed = await options.authorizeFanOut(identity, envelope.fanOut.table, envelope.functionPath);
-        if (!allowed) {
-          throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
-        }
-      } else if (envelope.functionPath.startsWith("__lunora_relation__:")) {
-        throw new LunoraError(
-          "reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker",
-          {
-            code: "FORBIDDEN_FANOUT",
-            status: 403
-          }
-        );
-      } else if (options.authorizeShard) {
-        throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
-          code: "FORBIDDEN_FANOUT",
-          status: 403
-        });
-      } else {
-        warnUnauthenticatedShardAccessOnce("fan-out");
-      }
+      await authorizeFanOutEnvelope(envelope.fanOut, envelope.functionPath, identity);
       return;
     }
     if (options.authorizeShard) {
@@ -2106,7 +2562,7 @@ const createWorker = (options) => {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (envelope.shardKey !== void 0 && envelope.shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
     }
   };
   const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
@@ -2118,7 +2574,7 @@ const createWorker = (options) => {
       method: "POST"
     });
     try {
-      const response = await forwardToShard(options.shardDO, shardKey, forwarded);
+      const response = await forwardToShard(shardDO, shardKey, forwarded);
       emitRpcEvent(
         observability,
         {
@@ -2147,6 +2603,7 @@ const createWorker = (options) => {
       throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
     }
     const envelope = await parseEnvelope(request);
+    logRpcDebug(env, envelope);
     if (envelope.fanOut && envelope.shardKey) {
       throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
     }
@@ -2162,14 +2619,14 @@ const createWorker = (options) => {
         status: 400
       });
     }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
     {
       const rpcStartedAt = Date.now();
       const { observability } = options;
       const sinkContext = context ? {
         waitUntil: (promise) => {
-          context.waitUntil(promise);
+          context.waitUntil?.(promise);
         }
       } : void 0;
       if (envelope.fanOut) {
@@ -2181,7 +2638,7 @@ const createWorker = (options) => {
           });
         }
         try {
-          const result = await coordinator.fanOut(options.shardDO, {
+          const result = await coordinator.fanOut(shardDO, {
             args: envelope.args ?? {},
             fanOut: envelope.fanOut,
             functionPath: envelope.functionPath,
@@ -2218,13 +2675,132 @@ const createWorker = (options) => {
       return dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
     }
   };
+  const handleBatchRpc = async (request, env, context) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("RPC batch endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const text = await readBodyTextWithLimit(request);
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new LunoraError("RPC batch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+      throw new LunoraError("RPC batch body must be an object", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { calls } = body;
+    if (!Array.isArray(calls)) {
+      throw new LunoraError("RPC batch `calls` must be an array", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const groups = groupBatchCallsByShard(calls, defaultShard);
+    await Promise.all(
+      [...groups.entries()].flatMap(
+        ([shardKey, entries]) => entries.map((entry) => authorizeRpcEnvelope({ functionPath: entry.functionPath, shardKey }, identity))
+      )
+    );
+    const { observability } = options;
+    const sinkContext = context ? {
+      waitUntil: (promise) => {
+        context.waitUntil?.(promise);
+      }
+    } : void 0;
+    const results = [];
+    let latestBookmark;
+    const slotError = (entry, status, code, message) => {
+      return { body: { error: { code, message } }, id: entry.id, status };
+    };
+    const failSubBatch = (entries, status, code, message, eventFor) => {
+      for (const entry of entries) {
+        emitRpcEvent(observability, eventFor(entry), sinkContext);
+        results.push(slotError(entry, status, code, message));
+      }
+    };
+    const emitEntryEvents = (entries, shardKey, durationMs, statusById, fallbackStatus) => {
+      for (const entry of entries) {
+        const status = statusById.get(entry.id) ?? fallbackStatus;
+        const ok = status < 400;
+        emitRpcEvent(
+          observability,
+          {
+            durationMs,
+            functionPath: entry.functionPath,
+            ok,
+            shardKey,
+            ...ok ? {} : { error: { code: "SHARD_ERROR", message: `batched call returned ${String(status)}`, status } }
+          },
+          sinkContext
+        );
+      }
+    };
+    await Promise.all(
+      [...groups.entries()].map(async ([shardKey, entries]) => {
+        const headers = new Headers(forwardedHeaders);
+        headers.set("content-type", "application/json");
+        const subRequest = new Request("https://shard.internal/rpc-batch", { body: JSON.stringify({ calls: entries }), headers, method: "POST" });
+        const subStartedAt = Date.now();
+        let response;
+        try {
+          response = await forwardToShard(shardDO, shardKey, subRequest);
+        } catch (error) {
+          const durationMs2 = Date.now() - subStartedAt;
+          const { body: errorBody } = toErrorBody(error, { fallbackCode: "SHARD_UNAVAILABLE", redactedMessage: "shard unavailable" });
+          failSubBatch(
+            entries,
+            502,
+            errorBody.code,
+            errorBody.message,
+            (entry) => buildErrorEvent(entry.functionPath, durationMs2, error, { shardKey })
+          );
+          return;
+        }
+        const durationMs = Date.now() - subStartedAt;
+        const bookmark = response.headers.get("x-d1-bookmark");
+        if (bookmark) {
+          latestBookmark = bookmark;
+        }
+        let parsed;
+        try {
+          parsed = await response.json();
+        } catch {
+          const message = `shard batch returned a non-JSON response (${String(response.status)})`;
+          failSubBatch(entries, response.status, "SHARD_ERROR", message, (entry) => {
+            return {
+              durationMs,
+              error: { code: "SHARD_ERROR", message, status: response.status },
+              functionPath: entry.functionPath,
+              ok: false,
+              shardKey
+            };
+          });
+          return;
+        }
+        const entryResults = Array.isArray(parsed.results) ? parsed.results : [];
+        const statusById = new Map(entryResults.map((entry) => [entry.id, entry.status ?? response.status]));
+        const seenIds = new Set(entryResults.map((entry) => entry.id));
+        emitEntryEvents(entries, shardKey, durationMs, statusById, response.status);
+        results.push(...entryResults);
+        for (const entry of entries) {
+          if (!seenIds.has(entry.id)) {
+            results.push(slotError(entry, response.status, "SHARD_ERROR", `shard batch omitted result for call ${String(entry.id)}`));
+          }
+        }
+      })
+    );
+    const responseHeaders = { "content-type": "application/json" };
+    if (latestBookmark !== void 0) {
+      responseHeaders["x-d1-bookmark"] = latestBookmark;
+    }
+    return Response.json({ results }, { headers: responseHeaders, status: 200 });
+  };
   const serverQuery = async (request, env, reference, args = {}, callOptions = {}) => {
     try {
       const functionPath = reference.__lunoraRef;
       if (typeof functionPath !== "string") {
         throw new LunoraError("serverQuery: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
       }
-      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
       await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
       const shardKey = callOptions.shardKey ?? defaultShard;
       return await dispatchSingleShard(functionPath, args, shardKey, forwardedHeaders);
@@ -2290,7 +2866,7 @@ const createWorker = (options) => {
           streamController.enqueue(encoded);
         };
         try {
-          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow);
+          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
           streamController.close();
         } catch (error) {
           streamError = error instanceof Error ? error : new Error(String(error));
@@ -2359,7 +2935,7 @@ const createWorker = (options) => {
         headers: { authorization: `Bearer ${adminBearer}`, "content-type": "application/json" },
         method: "POST"
       });
-      await forwardToShard(options.shardDO, defaultShard, recordRequest);
+      await forwardToShard(shardDO, defaultShard, recordRequest);
     } catch {
     }
   };
@@ -2373,13 +2949,21 @@ const createWorker = (options) => {
     }
     const basePath = options.authBasePath ?? DEFAULT_AUTH_BASE_PATH;
     if (isAuthAttemptPath(url.pathname, basePath)) {
-      context.waitUntil(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
+      context.waitUntil?.(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
     }
     return authResponse;
   };
+  const customRoutes = options.routes !== void 0 && Object.keys(options.routes).length > 0 ? options.routes : void 0;
   const internalRoutes = {
+    [STATUS_PATH]: (request) => {
+      if (request.method !== "GET" && request.method !== "HEAD") {
+        return new Response(void 0, { headers: { allow: "GET, HEAD" }, status: 405 });
+      }
+      return Response.json({ ok: true }, { headers: { "cache-control": "no-store" } });
+    },
     [WS_PATH]: (request, env, url) => handleWebSocketUpgrade(request, env, url),
     [RPC_PATH]: (request, env, _url, context) => handleRpc(request, env, context),
+    [RPC_BATCH_PATH]: (request, env, _url, context) => handleBatchRpc(request, env, context),
     [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
     [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
     // Extracted handler clusters built above, merged in (mirroring the auth
@@ -2393,6 +2977,7 @@ const createWorker = (options) => {
     ...workflowsAdminRoutes,
     ...storageAdminRoutes,
     ...vectorAdminRoutes,
+    ...kvAdminRoutes,
     ...introspectionAdminRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
@@ -2413,6 +2998,17 @@ const createWorker = (options) => {
       resolvedSecurity = resolveSecurity(options.security, env ?? {});
     }
   };
+  const applyAdminGate = async (request, pathname) => {
+    if (options.adminGate === void 0 || !isAdminPath(pathname)) {
+      return;
+    }
+    try {
+      if (await options.adminGate(request)) {
+        accessAdminGrants.add(request);
+      }
+    } catch {
+    }
+  };
   const handle = async (request, env, context) => {
     const url = new URL(request.url);
     if (request.method === "POST" || request.method === "PUT") {
@@ -2425,13 +3021,16 @@ const createWorker = (options) => {
     if (authResponse) {
       return authResponse;
     }
-    const methodAndPath = `${request.method} ${url.pathname}`;
-    const route = options.routes?.[methodAndPath] ?? options.routes?.[url.pathname];
-    if (route) {
-      return route(request, env, context);
+    if (customRoutes) {
+      const methodAndPath = `${request.method} ${url.pathname}`;
+      const route = customRoutes[methodAndPath] ?? customRoutes[url.pathname];
+      if (route) {
+        return route(request, env, context);
+      }
     }
     const internalRoute = internalRoutes[url.pathname];
     if (internalRoute) {
+      await applyAdminGate(request, url.pathname);
       return internalRoute(request, env, url, context);
     }
     const httpRouteResponse = await dispatchHttpRoute(request, env, context);
@@ -2443,7 +3042,7 @@ const createWorker = (options) => {
   return {
     async fetch(request, env, context) {
       if (options.passThroughOnException) {
-        context.passThroughOnException();
+        context.passThroughOnException?.();
       }
       ensureSecurityResolved(env);
       resolveAdminTokenFromEnv(env);
@@ -2462,6 +3061,9 @@ const createWorker = (options) => {
         return decorateResponse(toErrorResponse(error), request, resolvedSecurity);
       }
     },
+    async queue(batch, env, context) {
+      await options.queue?.(batch, env, context);
+    },
     async scheduled(controller, env, context) {
       await handleScheduled(controller, env, context);
     },
@@ -2492,10 +3094,24 @@ const withFrameworkWorker = (host, optionsInput) => {
   const optionsFactory = optionsInput;
   return {
     fetch: (request, env, context) => build(optionsFactory(env)).fetch(request, env, context),
+    queue: (batch, env, context) => build(optionsFactory(env)).queue?.(batch, env, context) ?? Promise.resolve(),
     scheduled: (controller, env, context) => build(optionsFactory(env)).scheduled(controller, env, context),
     serverQuery: (request, env, reference, args, options) => build(optionsFactory(env)).serverQuery(request, env, reference, args, options)
   };
 };
+const resolveLunoraOptions = (options, env) => {
+  if (typeof options === "function") {
+    return options(env);
+  }
+  const shardDO = options.shardDO ?? env?.SHARD;
+  if (!shardDO) {
+    throw new LunoraError(
+      "@lunora/runtime: no shard Durable Object namespace found. Bind `SHARD` in wrangler.jsonc, or pass `createLunoraHandler({ shardDO: env.MY_SHARD })`."
+    );
+  }
+  return { ...options, shardDO };
+};
+const createLunoraHandler = (options = {}) => (request, env, context) => createWorker(resolveLunoraOptions(options, env)).fetch(request, env, context ?? NOOP_EXECUTION_CONTEXT);
 const defineRpcEnvelope = (envelope) => envelope;
 
-export { composeWorker, createWorker, defineRpcEnvelope, withFrameworkWorker };
+export { NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker };