@lunora/runtime 1.0.0-alpha.221 → 1.0.0-alpha.223

package/dist/index.d.mts

@@ -1911,6 +1911,12 @@ interface KvIntrospector {
 interface ErrorDetail {
   /** The `LunoraError` taxonomy code, when the thrown value carries one. */
   code?: string;
+  /**
+   * The operator-only `internal` context of a `LunoraError`, when it is JSON-safe.
+   * Attached by the shard only on the detail header (see {@link describeInternal}),
+   * never by {@link describeError}, so it cannot leak into a log-event `error`.
+   */
+  internal?: Record<string, unknown>;
   message: string;
   name: string;
   stack?: string;
@@ -2414,6 +2420,13 @@ interface SpanEvent {
  * per-shard failure count.
  */
 interface ObservabilityEvent {
+  /**
+   * Extra attributes for this dispatch, e.g. derived by an `enrichSink` enricher.
+   * `otlpSink` exports them as span attributes. A reserved attribute of the same name
+   * wins: a key here never replaces a built-in field such as `http.route` or
+   * `lunora.shard_key`, and the colliding key is dropped.
+   */
+  attributes?: LogFields;
   /** Wall-clock duration of the dispatch, in milliseconds. */
   durationMs: number;
   /**
@@ -2425,6 +2438,12 @@ interface ObservabilityEvent {
    */
   error?: {
     code: string;
+    /**
+     * Operator-only context from the thrown `LunoraError`'s `internal`. Sinks only:
+     * it is never sent to a client. {@link emitRpcEvent} runs it through `redactCredentials`
+     * before a sink sees it: credential-named fields only, so ids and URLs survive.
+     */
+    internal?: Record<string, unknown>;
     message: string;
     name?: string;
     stack?: string;
@@ -4981,7 +5000,9 @@ declare class LunoraError extends LunoraError$1 {
   constructor(message: string, options?: {
     cause?: unknown;
     code?: string;
+    internal?: Record<string, unknown>;
     status?: number;
+    why?: string;
   });
   toResponse(): Response;
 }
@@ -5060,6 +5081,61 @@ interface MemoizeIdentityOptions {
  * serve one principal's identity to another — see that option's contract.
  */
 declare const memoizeIdentity: (resolver: IdentityResolver, options?: MemoizeIdentityOptions) => IdentityResolver;
+/** The four signal kinds a sink receives. */
+type SinkSignalKind = "log" | "metric" | "rpc" | "span";
+/** Any event a sink receives. Every variant carries `functionPath`. */
+type SinkEvent = LogEvent | MetricEvent | ObservabilityEvent | SpanEvent;
+/**
+ * Derives extra attributes for one event. Return `undefined` (or an empty bag)
+ * to add nothing.
+ *
+ * The result is normalized to JSON-safe primitives and redacted the way the signal's
+ * own fields are: `redactArgs` for log lines, and the credential-only `redactCredentials`
+ * for metrics, spans and RPC events, whose ids and URLs the PII rules would erase. It
+ * is merged UNDER the event's own attributes: a key the event already sets keeps its value.
+ *
+ * If the enricher throws, the event is delivered unchanged and the failure is logged
+ * (a bounded number of times per isolate). Enrichment only adds fields and never removes
+ * or reveals anything, so failing open is safe here. Unlike a `postProcessor`, which fails
+ * closed because it is a privacy control.
+ */
+type SinkEnricher = (event: SinkEvent, signal: SinkSignalKind) => LogFields | undefined;
+/**
+ * Route signals by `functionPath`, using `*` as the only wildcard (any run of
+ * characters, including `:` and `/`). Matching is case-sensitive.
+ *
+ * - `exclude` always wins over `include`.
+ * - An absent or empty `include` matches every path.
+ *
+ * Platform records use synthetic paths such as `ttl:sweep` or `scheduler:outbox`, and some
+ * are kept only in the shard's local log. Those never reach a sink, so no filter can route
+ * them; only the records a sink actually receives are matched against `include` and `exclude`.
+ */
+interface SinkRouteOptions {
+  /** Patterns that drop a path, even when `include` matches it. */
+  exclude?: string[];
+  /** Patterns a path must match to pass. Absent or empty passes everything. */
+  include?: string[];
+}
+/**
+ * Wrap a sink so every event it receives carries the enricher's attributes: log
+ * lines under `fields`, and metrics, spans and RPC events under `attributes`.
+ *
+ * The result is a fresh object per event, never a mutation, because one event
+ * object fans out to every `combineSinks` child and to the shard's local buffers.
+ * @param sink The sink to deliver enriched events to.
+ * @param enrich Derives the extra attributes for each event.
+ */
+declare const enrichSink: (sink: ObservabilitySink, enrich: SinkEnricher) => ObservabilitySink;
+/**
+ * Wrap a sink so it receives only the signals whose `functionPath` passes the
+ * route options. Applies to all four signal kinds, since each carries a path.
+ * A dropped event never reaches the wrapped sink, and no enricher runs for it
+ * when `filterSink` wraps an `enrichSink`.
+ * @param sink The sink to deliver the routed events to.
+ * @param options The include and exclude patterns. See `SinkRouteOptions`.
+ */
+declare const filterSink: (sink: ObservabilitySink, options: SinkRouteOptions) => ObservabilitySink;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */
@@ -5594,4 +5670,4 @@ export { type AccessContextLike, type AccessIdentityLike, type AdminTableResolve
  * surface — without a name for it, a caller cannot hoist a shared attribute bag
  * into a typed constant.
  */
-type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type PrunedBackups, type QueryCoordinator, type QueryCoordinatorOptions, type QueueForwardBatch, type QueueForwardHandler, type QueueForwardMessage, type QueueForwardResult, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ReportedError, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, STORAGE_UPLOAD_MAX_BODY_BYTES, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCaller, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StackFrame, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TriggerTrace, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, backupManifestKey, backupObjectKey, backupObjectKeyOfManifest, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, declareAppJurisdiction, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, isBackupManifestEntry, isBackupManifestKey, memoizeIdentity, memoizeIdentityPerRequest, normalizeBackupPrefix, otlpSink, parseStackFrames, pipelineLogSink, presenceProbe, r2Sink, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, toAirbyteMessages, toError, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type PrunedBackups, type QueryCoordinator, type QueryCoordinatorOptions, type QueueForwardBatch, type QueueForwardHandler, type QueueForwardMessage, type QueueForwardResult, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ReportedError, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, STORAGE_UPLOAD_MAX_BODY_BYTES, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCaller, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SinkEnricher, type SinkEvent, type SinkRouteOptions, type SinkSignalKind, type SpanEvent, type StackFrame, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TriggerTrace, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, backupManifestKey, backupObjectKey, backupObjectKeyOfManifest, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, declareAppJurisdiction, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, enrichSink, filterSink, handleCorsPreflight, isBackupManifestEntry, isBackupManifestKey, memoizeIdentity, memoizeIdentityPerRequest, normalizeBackupPrefix, otlpSink, parseStackFrames, pipelineLogSink, presenceProbe, r2Sink, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, toAirbyteMessages, toError, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -1911,6 +1911,12 @@ interface KvIntrospector {
 interface ErrorDetail {
   /** The `LunoraError` taxonomy code, when the thrown value carries one. */
   code?: string;
+  /**
+   * The operator-only `internal` context of a `LunoraError`, when it is JSON-safe.
+   * Attached by the shard only on the detail header (see {@link describeInternal}),
+   * never by {@link describeError}, so it cannot leak into a log-event `error`.
+   */
+  internal?: Record<string, unknown>;
   message: string;
   name: string;
   stack?: string;
@@ -2414,6 +2420,13 @@ interface SpanEvent {
  * per-shard failure count.
  */
 interface ObservabilityEvent {
+  /**
+   * Extra attributes for this dispatch, e.g. derived by an `enrichSink` enricher.
+   * `otlpSink` exports them as span attributes. A reserved attribute of the same name
+   * wins: a key here never replaces a built-in field such as `http.route` or
+   * `lunora.shard_key`, and the colliding key is dropped.
+   */
+  attributes?: LogFields;
   /** Wall-clock duration of the dispatch, in milliseconds. */
   durationMs: number;
   /**
@@ -2425,6 +2438,12 @@ interface ObservabilityEvent {
    */
   error?: {
     code: string;
+    /**
+     * Operator-only context from the thrown `LunoraError`'s `internal`. Sinks only:
+     * it is never sent to a client. {@link emitRpcEvent} runs it through `redactCredentials`
+     * before a sink sees it: credential-named fields only, so ids and URLs survive.
+     */
+    internal?: Record<string, unknown>;
     message: string;
     name?: string;
     stack?: string;
@@ -4981,7 +5000,9 @@ declare class LunoraError extends LunoraError$1 {
   constructor(message: string, options?: {
     cause?: unknown;
     code?: string;
+    internal?: Record<string, unknown>;
     status?: number;
+    why?: string;
   });
   toResponse(): Response;
 }
@@ -5060,6 +5081,61 @@ interface MemoizeIdentityOptions {
  * serve one principal's identity to another — see that option's contract.
  */
 declare const memoizeIdentity: (resolver: IdentityResolver, options?: MemoizeIdentityOptions) => IdentityResolver;
+/** The four signal kinds a sink receives. */
+type SinkSignalKind = "log" | "metric" | "rpc" | "span";
+/** Any event a sink receives. Every variant carries `functionPath`. */
+type SinkEvent = LogEvent | MetricEvent | ObservabilityEvent | SpanEvent;
+/**
+ * Derives extra attributes for one event. Return `undefined` (or an empty bag)
+ * to add nothing.
+ *
+ * The result is normalized to JSON-safe primitives and redacted the way the signal's
+ * own fields are: `redactArgs` for log lines, and the credential-only `redactCredentials`
+ * for metrics, spans and RPC events, whose ids and URLs the PII rules would erase. It
+ * is merged UNDER the event's own attributes: a key the event already sets keeps its value.
+ *
+ * If the enricher throws, the event is delivered unchanged and the failure is logged
+ * (a bounded number of times per isolate). Enrichment only adds fields and never removes
+ * or reveals anything, so failing open is safe here. Unlike a `postProcessor`, which fails
+ * closed because it is a privacy control.
+ */
+type SinkEnricher = (event: SinkEvent, signal: SinkSignalKind) => LogFields | undefined;
+/**
+ * Route signals by `functionPath`, using `*` as the only wildcard (any run of
+ * characters, including `:` and `/`). Matching is case-sensitive.
+ *
+ * - `exclude` always wins over `include`.
+ * - An absent or empty `include` matches every path.
+ *
+ * Platform records use synthetic paths such as `ttl:sweep` or `scheduler:outbox`, and some
+ * are kept only in the shard's local log. Those never reach a sink, so no filter can route
+ * them; only the records a sink actually receives are matched against `include` and `exclude`.
+ */
+interface SinkRouteOptions {
+  /** Patterns that drop a path, even when `include` matches it. */
+  exclude?: string[];
+  /** Patterns a path must match to pass. Absent or empty passes everything. */
+  include?: string[];
+}
+/**
+ * Wrap a sink so every event it receives carries the enricher's attributes: log
+ * lines under `fields`, and metrics, spans and RPC events under `attributes`.
+ *
+ * The result is a fresh object per event, never a mutation, because one event
+ * object fans out to every `combineSinks` child and to the shard's local buffers.
+ * @param sink The sink to deliver enriched events to.
+ * @param enrich Derives the extra attributes for each event.
+ */
+declare const enrichSink: (sink: ObservabilitySink, enrich: SinkEnricher) => ObservabilitySink;
+/**
+ * Wrap a sink so it receives only the signals whose `functionPath` passes the
+ * route options. Applies to all four signal kinds, since each carries a path.
+ * A dropped event never reaches the wrapped sink, and no enricher runs for it
+ * when `filterSink` wraps an `enrichSink`.
+ * @param sink The sink to deliver the routed events to.
+ * @param options The include and exclude patterns. See `SinkRouteOptions`.
+ */
+declare const filterSink: (sink: ObservabilitySink, options: SinkRouteOptions) => ObservabilitySink;
 /** Shared shape for sinks that can be limited to error events only. */
 interface OnlyErrorsOption {
   /** When true, only events with `ok === false` are forwarded. */
@@ -5594,4 +5670,4 @@ export { type AccessContextLike, type AccessIdentityLike, type AdminTableResolve
  * surface — without a name for it, a caller cannot hoist a shared attribute bag
  * into a typed constant.
  */
-type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type PrunedBackups, type QueryCoordinator, type QueryCoordinatorOptions, type QueueForwardBatch, type QueueForwardHandler, type QueueForwardMessage, type QueueForwardResult, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ReportedError, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, STORAGE_UPLOAD_MAX_BODY_BYTES, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCaller, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SpanEvent, type StackFrame, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TriggerTrace, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, backupManifestKey, backupObjectKey, backupObjectKeyOfManifest, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, declareAppJurisdiction, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, isBackupManifestEntry, isBackupManifestKey, memoizeIdentity, memoizeIdentityPerRequest, normalizeBackupPrefix, otlpSink, parseStackFrames, pipelineLogSink, presenceProbe, r2Sink, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, toAirbyteMessages, toError, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };
+type OtlpResourceAttributes, type OtlpSinkOptions, type PipelineLike, type PipelineLogColumnMap, type PipelineLogCursor, type PipelineLogField, type PipelineLogPage, type PipelineLogQuery, type PipelineLogReader, type PipelineLogReaderOptions, type PipelineLogRow, type PipelineLogSinkOptions, type PrunedBackups, type QueryCoordinator, type QueryCoordinatorOptions, type QueueForwardBatch, type QueueForwardHandler, type QueueForwardMessage, type QueueForwardResult, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type RateLimiterLike, type ReportedError, type ResolvedSecurity, type ResolvedShard, type RestInvoke, type RestRateLimit, type RestRegistryEntry, type RestRegistryLike, type RestRoute, type RestRouteDeps, type Route, type RpcContext, type RpcEnvelope, type RunExportTapOptions, SHARD_REGISTRY_DO_NAME, STORAGE_UPLOAD_MAX_BODY_BYTES, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type ShardCallArgs, type ShardCallOptions, type ShardCallReturn, type ShardCaller, type ShardCallerIdentity, type ShardClient, type ShardClientOptions, type ShardError, type ShardExportOutcome, type ShardFunctionReference, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceInput, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type SinkEnricher, type SinkEvent, type SinkRouteOptions, type SinkSignalKind, type SpanEvent, type StackFrame, type StorageListFunction as StorageListFn, type StorageObject, type TraceSamplingConfig, type TraceTrustSignal, type TriggerTrace, type TrustInboundTraceContext, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, applyRestCache, argsFromQuery, backupManifestKey, backupObjectKey, backupObjectKeyOfManifest, buildHealthRoutes, buildRestRoutes, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createKvCursorStore, createLunoraHandler, createMemoryCursorStore, createPipelineLogReader, createQueryCoordinator, createRestRateLimit, createShardClient, createStaticShardRegistry, createWorker, d1Probe, declareAppJurisdiction, decorateResponse, defineExportSink, defineRpcEnvelope, durableObjectProbe, emitLogEvent, emitRpcEvent, enforceOrigin, enrichSink, filterSink, handleCorsPreflight, isBackupManifestEntry, isBackupManifestKey, memoizeIdentity, memoizeIdentityPerRequest, normalizeBackupPrefix, otlpSink, parseStackFrames, pipelineLogSink, presenceProbe, r2Sink, requestCarriesCredentials, resolveLogArchiveFromEnv, resolveLunoraOptions, resolveSecurity, resolveShard, restCacheHeaders, restSurfaceFromRegistry, routeIdentityResolvers, runExportTap, sanitizeChange, toAirbyteMessages, toError, toErrorResponse, toFivetranResponse, webhookExportSink, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1 +1 @@
-import{declareAppJurisdiction as t}from"./packem_shared/declareAppJurisdiction-DEba2p42.mjs";import{BACKUP_KEY_PREFIX as s,backupManifestKey as i,backupObjectKey as p,backupObjectKeyOfManifest as n,isBackupManifestEntry as c,isBackupManifestKey as m,normalizeBackupPrefix as f}from"./packem_shared/BACKUP_KEY_PREFIX-BOtSu-_3.mjs";import{toAirbyteMessages as R,toFivetranResponse as x}from"./packem_shared/toAirbyteMessages-DY0vsuEn.mjs";import{composeWorker as l,createLunoraHandler as d,createWorker as u,defineRpcEnvelope as _,resolveLunoraOptions as k,withFrameworkWorker as y}from"./packem_shared/composeWorker-DV9PGw3Z.mjs";import{createCrossShardRelationCapabilities as O}from"./packem_shared/createCrossShardRelationCapabilities-BmGOuTrp.mjs";import{DEFAULT_REGISTRY_CACHE_TTL_MS as A,SHARD_REGISTRY_DO_NAME as L,createDynamicShardRegistry as T}from"./packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-CdACWUQW.mjs";import{parseStackFrames as H,toError as P}from"./packem_shared/parseStackFrames-CZddjveh.mjs";import{LunoraError as v,toErrorResponse as I}from"./packem_shared/LunoraError-DksAgIpa.mjs";import{c as F,a as M,d as N,r as G,b as K,s as U,w as B}from"./packem_shared/export-tap-C2B_SATf.mjs";import{HEALTH_PATH as w,HEALTH_READY_PATH as z,buildHealthRoutes as X,d1Probe as j,durableObjectProbe as V,presenceProbe as W}from"./packem_shared/HEALTH_PATH-CAX2UeFy.mjs";import{LOG_ARCHIVE_PATH as J,resolveLogArchiveFromEnv as Q}from"./packem_shared/LOG_ARCHIVE_PATH-Hmjpz_Ko.mjs";import{memoizeIdentity as $,memoizeIdentityPerRequest as ee}from"./packem_shared/memoizeIdentity-BNnHkqeF.mjs";import{e as oe,a as te}from"./packem_shared/observability-DgurIZIR.mjs";import{analyticsEngineSink as se,combineSinks as ie,consoleSink as pe,otlpSink as ne,pipelineLogSink as ce,webhookSink as me}from"./packem_shared/analyticsEngineSink-BZB-ZYCP.mjs";import{D as Ee,c as Re}from"./packem_shared/pipeline-log-reader-C-nuWG_e.mjs";import{createQueryCoordinator as Se,createStaticShardRegistry as le}from"./packem_shared/createQueryCoordinator-es4jrL6Q.mjs";import{applyJurisdiction as ue,resolveShard as _e}from"./packem_shared/applyJurisdiction-D4vryLhj.mjs";import{a as ye,r as Ce,b as Oe}from"./packem_shared/rest-cache-CmHN871W.mjs";import{a as Ae,b as Le,c as Te,r as he}from"./packem_shared/rest-routes-DQkyqlym.mjs";import{decorateResponse as Pe,enforceOrigin as ge,handleCorsPreflight as ve,resolveSecurity as Ie}from"./packem_shared/decorateResponse-CRBbtPYT.mjs";import{createShardClient as Fe}from"./packem_shared/createShardClient-DIVRljRz.mjs";import{STORAGE_UPLOAD_MAX_BODY_BYTES as Ne}from"./packem_shared/STORAGE_UPLOAD_MAX_BODY_BYTES-BIiV5kqV.mjs";import{LOG_ARCHIVE_NOT_CONFIGURED as Ke}from"./packem_shared/LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{NOOP_EXECUTION_CONTEXT as Be}from"./packem_shared/NOOP_EXECUTION_CONTEXT-YmXqH-jH.mjs";import{composeIdentityResolvers as we,routeIdentityResolvers as ze}from"./packem_shared/composeIdentityResolvers-BHZ4jH8o.mjs";const e="0.0.0";export{s as BACKUP_KEY_PREFIX,Ee as DEFAULT_LOG_COLUMNS,A as DEFAULT_REGISTRY_CACHE_TTL_MS,w as HEALTH_PATH,z as HEALTH_READY_PATH,Ke as LOG_ARCHIVE_NOT_CONFIGURED,J as LOG_ARCHIVE_PATH,v as LunoraError,Be as NOOP_EXECUTION_CONTEXT,L as SHARD_REGISTRY_DO_NAME,Ne as STORAGE_UPLOAD_MAX_BODY_BYTES,e as VERSION,se as analyticsEngineSink,ue as applyJurisdiction,ye as applyRestCache,Ae as argsFromQuery,i as backupManifestKey,p as backupObjectKey,n as backupObjectKeyOfManifest,X as buildHealthRoutes,Le as buildRestRoutes,ie as combineSinks,we as composeIdentityResolvers,l as composeWorker,pe as consoleSink,O as createCrossShardRelationCapabilities,T as createDynamicShardRegistry,F as createKvCursorStore,d as createLunoraHandler,M as createMemoryCursorStore,Re as createPipelineLogReader,Se as createQueryCoordinator,Te as createRestRateLimit,Fe as createShardClient,le as createStaticShardRegistry,u as createWorker,j as d1Probe,t as declareAppJurisdiction,Pe as decorateResponse,N as defineExportSink,_ as defineRpcEnvelope,V as durableObjectProbe,oe as emitLogEvent,te as emitRpcEvent,ge as enforceOrigin,ve as handleCorsPreflight,c as isBackupManifestEntry,m as isBackupManifestKey,$ as memoizeIdentity,ee as memoizeIdentityPerRequest,f as normalizeBackupPrefix,ne as otlpSink,H as parseStackFrames,ce as pipelineLogSink,W as presenceProbe,G as r2Sink,Ce as requestCarriesCredentials,Q as resolveLogArchiveFromEnv,k as resolveLunoraOptions,Ie as resolveSecurity,_e as resolveShard,Oe as restCacheHeaders,he as restSurfaceFromRegistry,ze as routeIdentityResolvers,K as runExportTap,U as sanitizeChange,R as toAirbyteMessages,P as toError,I as toErrorResponse,x as toFivetranResponse,B as webhookExportSink,me as webhookSink,y as withFrameworkWorker};
+import{declareAppJurisdiction as t}from"./packem_shared/declareAppJurisdiction-DEba2p42.mjs";import{BACKUP_KEY_PREFIX as s,backupManifestKey as i,backupObjectKey as p,backupObjectKeyOfManifest as n,isBackupManifestEntry as c,isBackupManifestKey as m,normalizeBackupPrefix as f}from"./packem_shared/BACKUP_KEY_PREFIX-BOtSu-_3.mjs";import{toAirbyteMessages as x,toFivetranResponse as R}from"./packem_shared/toAirbyteMessages-DY0vsuEn.mjs";import{composeWorker as l,createLunoraHandler as d,createWorker as u,defineRpcEnvelope as _,resolveLunoraOptions as k,withFrameworkWorker as b}from"./packem_shared/composeWorker-CTB0-5ke.mjs";import{createCrossShardRelationCapabilities as C}from"./packem_shared/createCrossShardRelationCapabilities-C8lpyW1a.mjs";import{DEFAULT_REGISTRY_CACHE_TTL_MS as A,SHARD_REGISTRY_DO_NAME as L,createDynamicShardRegistry as T}from"./packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-Jrpa-kBx.mjs";import{parseStackFrames as H,toError as P}from"./packem_shared/parseStackFrames-CZddjveh.mjs";import{LunoraError as v,toErrorResponse as I}from"./packem_shared/LunoraError-PkZWF-_g.mjs";import{c as F,a as M,d as N,r as G,b as K,s as U,w}from"./packem_shared/export-tap-C2B_SATf.mjs";import{HEALTH_PATH as Y,HEALTH_READY_PATH as z,buildHealthRoutes as X,d1Probe as j,durableObjectProbe as V,presenceProbe as W}from"./packem_shared/HEALTH_PATH-B8ndDG3s.mjs";import{LOG_ARCHIVE_PATH as J,resolveLogArchiveFromEnv as Q}from"./packem_shared/LOG_ARCHIVE_PATH-dTuCzfyj.mjs";import{memoizeIdentity as $,memoizeIdentityPerRequest as ee}from"./packem_shared/memoizeIdentity-BNnHkqeF.mjs";import{e as oe,a as te}from"./packem_shared/observability-9slk__Gi.mjs";import{enrichSink as se,filterSink as ie}from"./packem_shared/enrichSink-44NOapaE.mjs";import{a as ne,c as ce,b as me,o as fe,p as Ee,w as xe}from"./packem_shared/observability-sinks-lLKqc_rV.mjs";import{D as Se,c as le}from"./packem_shared/pipeline-log-reader-C-nuWG_e.mjs";import{createQueryCoordinator as ue,createStaticShardRegistry as _e}from"./packem_shared/createQueryCoordinator-Bt6xVTQn.mjs";import{applyJurisdiction as be,resolveShard as ye}from"./packem_shared/applyJurisdiction-DKQE8kOA.mjs";import{a as Oe,r as Ae,b as Le}from"./packem_shared/rest-cache-CmHN871W.mjs";import{a as he,b as He,c as Pe,r as ge}from"./packem_shared/rest-routes-CDQ1F7kI.mjs";import{decorateResponse as Ie,enforceOrigin as De,handleCorsPreflight as Fe,resolveSecurity as Me}from"./packem_shared/decorateResponse-CdelJSUs.mjs";import{createShardClient as Ge}from"./packem_shared/createShardClient-BlcK9Nok.mjs";import{STORAGE_UPLOAD_MAX_BODY_BYTES as Ue}from"./packem_shared/STORAGE_UPLOAD_MAX_BODY_BYTES-DiZho96u.mjs";import{LOG_ARCHIVE_NOT_CONFIGURED as Be}from"./packem_shared/LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{NOOP_EXECUTION_CONTEXT as ze}from"./packem_shared/NOOP_EXECUTION_CONTEXT-YmXqH-jH.mjs";import{composeIdentityResolvers as je,routeIdentityResolvers as Ve}from"./packem_shared/composeIdentityResolvers-CpdHuDyk.mjs";const e="0.0.0";export{s as BACKUP_KEY_PREFIX,Se as DEFAULT_LOG_COLUMNS,A as DEFAULT_REGISTRY_CACHE_TTL_MS,Y as HEALTH_PATH,z as HEALTH_READY_PATH,Be as LOG_ARCHIVE_NOT_CONFIGURED,J as LOG_ARCHIVE_PATH,v as LunoraError,ze as NOOP_EXECUTION_CONTEXT,L as SHARD_REGISTRY_DO_NAME,Ue as STORAGE_UPLOAD_MAX_BODY_BYTES,e as VERSION,ne as analyticsEngineSink,be as applyJurisdiction,Oe as applyRestCache,he as argsFromQuery,i as backupManifestKey,p as backupObjectKey,n as backupObjectKeyOfManifest,X as buildHealthRoutes,He as buildRestRoutes,ce as combineSinks,je as composeIdentityResolvers,l as composeWorker,me as consoleSink,C as createCrossShardRelationCapabilities,T as createDynamicShardRegistry,F as createKvCursorStore,d as createLunoraHandler,M as createMemoryCursorStore,le as createPipelineLogReader,ue as createQueryCoordinator,Pe as createRestRateLimit,Ge as createShardClient,_e as createStaticShardRegistry,u as createWorker,j as d1Probe,t as declareAppJurisdiction,Ie as decorateResponse,N as defineExportSink,_ as defineRpcEnvelope,V as durableObjectProbe,oe as emitLogEvent,te as emitRpcEvent,De as enforceOrigin,se as enrichSink,ie as filterSink,Fe as handleCorsPreflight,c as isBackupManifestEntry,m as isBackupManifestKey,$ as memoizeIdentity,ee as memoizeIdentityPerRequest,f as normalizeBackupPrefix,fe as otlpSink,H as parseStackFrames,Ee as pipelineLogSink,W as presenceProbe,G as r2Sink,Ae as requestCarriesCredentials,Q as resolveLogArchiveFromEnv,k as resolveLunoraOptions,Me as resolveSecurity,ye as resolveShard,Le as restCacheHeaders,ge as restSurfaceFromRegistry,Ve as routeIdentityResolvers,K as runExportTap,U as sanitizeChange,x as toAirbyteMessages,P as toError,I as toErrorResponse,R as toFivetranResponse,w as webhookExportSink,xe as webhookSink,b as withFrameworkWorker};

package/dist/packem_shared/{DEFAULT_REGISTRY_CACHE_TTL_MS-CdACWUQW.mjs → DEFAULT_REGISTRY_CACHE_TTL_MS-Jrpa-kBx.mjs}

@@ -1 +1 @@
-import{LunoraError as a}from"./LunoraError-DksAgIpa.mjs";import{applyJurisdiction as S,resolveShard as _}from"./applyJurisdiction-D4vryLhj.mjs";const l="__lunora_shard_registry__",f=3e4,y="https://shard-registry.internal",g=async r=>await r.json(),T=r=>{const p=r.instanceName??l,i=r.cacheTtlMs??f,n=new Map,w=S(r.namespace,r.jurisdiction),c=()=>_(w,p),d=async(e,t)=>c().fetch(new Request(`${y}${e}`,{body:JSON.stringify(t),headers:{"content-type":"application/json"},method:"POST"})),h=async e=>c().fetch(new Request(`${y}${e}`,{method:"GET"}));return{invalidate(e){e===void 0?n.clear():n.delete(e)},async listShardKeys(e){const t=Date.now(),s=n.get(e);if(s&&s.expiresAt>t)return s.shardKeys;const o=await h(`/list?table=${encodeURIComponent(e)}`);if(!o.ok)throw new a(`shard registry /list returned ${String(o.status)}`);const{shardKeys:u}=await g(o);return i>0&&n.set(e,{expiresAt:t+i,shardKeys:u}),u},async register(e,t){const s=await d("/register",{shardKey:t,table:e});if(!s.ok)throw new a(`shard registry /register returned ${String(s.status)}`);n.delete(e)},async snapshot(){const e=await h("/snapshot");if(!e.ok)throw new a(`shard registry /snapshot returned ${String(e.status)}`);const{tables:t}=await g(e);return t},async unregister(e,t){const s=await d("/unregister",{shardKey:t,table:e});if(!s.ok)throw new a(`shard registry /unregister returned ${String(s.status)}`);n.delete(e)}}};export{f as DEFAULT_REGISTRY_CACHE_TTL_MS,l as SHARD_REGISTRY_DO_NAME,T as createDynamicShardRegistry};
+import{LunoraError as a}from"./LunoraError-PkZWF-_g.mjs";import{applyJurisdiction as S,resolveShard as _}from"./applyJurisdiction-DKQE8kOA.mjs";const l="__lunora_shard_registry__",f=3e4,y="https://shard-registry.internal",g=async r=>await r.json(),T=r=>{const p=r.instanceName??l,i=r.cacheTtlMs??f,n=new Map,w=S(r.namespace,r.jurisdiction),c=()=>_(w,p),d=async(e,t)=>c().fetch(new Request(`${y}${e}`,{body:JSON.stringify(t),headers:{"content-type":"application/json"},method:"POST"})),h=async e=>c().fetch(new Request(`${y}${e}`,{method:"GET"}));return{invalidate(e){e===void 0?n.clear():n.delete(e)},async listShardKeys(e){const t=Date.now(),s=n.get(e);if(s&&s.expiresAt>t)return s.shardKeys;const o=await h(`/list?table=${encodeURIComponent(e)}`);if(!o.ok)throw new a(`shard registry /list returned ${String(o.status)}`);const{shardKeys:u}=await g(o);return i>0&&n.set(e,{expiresAt:t+i,shardKeys:u}),u},async register(e,t){const s=await d("/register",{shardKey:t,table:e});if(!s.ok)throw new a(`shard registry /register returned ${String(s.status)}`);n.delete(e)},async snapshot(){const e=await h("/snapshot");if(!e.ok)throw new a(`shard registry /snapshot returned ${String(e.status)}`);const{tables:t}=await g(e);return t},async unregister(e,t){const s=await d("/unregister",{shardKey:t,table:e});if(!s.ok)throw new a(`shard registry /unregister returned ${String(s.status)}`);n.delete(e)}}};export{f as DEFAULT_REGISTRY_CACHE_TTL_MS,l as SHARD_REGISTRY_DO_NAME,T as createDynamicShardRegistry};

package/dist/packem_shared/{HEALTH_PATH-CAX2UeFy.mjs → HEALTH_PATH-B8ndDG3s.mjs}

@@ -1 +1 @@
-import{LunoraError as T}from"./LunoraError-DksAgIpa.mjs";import{m as A}from"./method-guard-BG_vJNTl.mjs";import{resolveShard as R}from"./applyJurisdiction-D4vryLhj.mjs";const H="/_lunora/health",C="/_lunora/health/ready",N=t=>t==="liveness"?["liveness"]:t==="readiness"?["readiness"]:["liveness","readiness"];class P{#e=new Map;addChecker(e,s,r){this.#e.set(e,{run:s,types:r.type})}async getReport(e){const s=[...this.#e].filter(([,a])=>e===void 0||a.types.includes(e)),r=await Promise.all(s.map(async([a,o])=>[a,await o.run()]));return{healthy:r.every(([,a])=>a.health.healthy),report:Object.fromEntries(r)}}}const S=t=>{const e=new P,s=new Set;for(const r of t)r.critical&&s.add(r.name),e.addChecker(r.name,async()=>{let a;try{a=await r.check()}catch(o){a={healthy:!1,message:o instanceof Error?o.message:"probe failed"}}return{health:{healthy:a.healthy,...a.message===void 0?{}:{message:a.message}}}},{type:N(r.kind)});return{criticalNames:s,registry:e}},_=(t,e)=>{const s=t.includes(":")?t.slice(0,t.indexOf(":")):"probe",r=(e.get(s)??0)+1;return e.set(s,r),r===1?s:`${s}#${String(r)}`},j=(t,e)=>t?"unhealthy":e?"degraded":"healthy",M=(t,e,s,r,a)=>{const o=[];let u=!1,d=!1;const y=new Map;for(const[h,c]of Object.entries(t)){const n=e.has(h),i=c.health.healthy;d=d||!i,u=u||!i&&n;const l=s==="admin"?h:_(h,y);o.push({critical:n,...s==="admin"&&c.health.message!==void 0?{message:c.health.message}:{},name:l,status:i?"up":"down"})}return o.sort((h,c)=>h.name<c.name?-1:+(h.name>c.name)),{anyCriticalDown:u,body:{appName:r,appVersion:a,checks:o,status:j(u,d),timestamp:new Date().toISOString()}}},G=t=>{const{appName:e="lunora",appVersion:s="0.0.0",auth:r="public",cacheTtlMs:a,isAdmin:o,resolveProbes:u}=t,d=n=>a!==void 0?a:n==="readiness"?0:r==="public"?5e3:0,y={},h=n=>{if(r==="admin"&&!o(n))throw new T("health endpoint requires a valid admin bearer",{code:"ADMIN_FORBIDDEN",status:403})},c=async(n,i,l)=>{const p=A(n,["GET","HEAD"]);if(p)return p;h(n);const f=d(l);if(f>0){const m=y[l];if(m!==void 0&&Date.now()<m.expiresAt)return Response.json(m.body,{headers:{"cache-control":"no-store"},status:m.down?503:200})}const{criticalNames:b,registry:v}=S(u(i)),{healthy:E,report:k}=await v.getReport(l==="readiness"?"readiness":void 0),{anyCriticalDown:D,body:g}=M(k,b,r,e,s),w=l==="readiness"?!E:D;return f>0&&(y[l]={body:g,down:w,expiresAt:Date.now()+f}),Response.json(g,{headers:{"cache-control":"no-store"},status:w?503:200})};return{[H]:(n,i)=>c(n,i,"aggregate"),[C]:(n,i)=>c(n,i,"readiness")}},I=(t,e,s)=>({check:async()=>{try{return await R(e,s).fetch(new Request("https://shard.internal/_lunora/status",{method:"GET"})),{healthy:!0}}catch{return{healthy:!1,message:"durable object unreachable"}}},critical:!0,name:t}),q=(t,e)=>({check:async()=>{try{return await e.prepare("SELECT 1").first(),{healthy:!0}}catch{return{healthy:!1,message:"d1 query failed"}}},critical:!0,name:t}),B=(t,e)=>({check:()=>e?{healthy:!0}:{healthy:!1,message:"binding not configured"},critical:!1,name:t});export{H as HEALTH_PATH,C as HEALTH_READY_PATH,G as buildHealthRoutes,q as d1Probe,I as durableObjectProbe,B as presenceProbe};
+import{LunoraError as T}from"./LunoraError-PkZWF-_g.mjs";import{m as A}from"./method-guard-8Jo4Q8uS.mjs";import{resolveShard as R}from"./applyJurisdiction-DKQE8kOA.mjs";const H="/_lunora/health",C="/_lunora/health/ready",N=t=>t==="liveness"?["liveness"]:t==="readiness"?["readiness"]:["liveness","readiness"];class P{#e=new Map;addChecker(e,s,r){this.#e.set(e,{run:s,types:r.type})}async getReport(e){const s=[...this.#e].filter(([,a])=>e===void 0||a.types.includes(e)),r=await Promise.all(s.map(async([a,o])=>[a,await o.run()]));return{healthy:r.every(([,a])=>a.health.healthy),report:Object.fromEntries(r)}}}const S=t=>{const e=new P,s=new Set;for(const r of t)r.critical&&s.add(r.name),e.addChecker(r.name,async()=>{let a;try{a=await r.check()}catch(o){a={healthy:!1,message:o instanceof Error?o.message:"probe failed"}}return{health:{healthy:a.healthy,...a.message===void 0?{}:{message:a.message}}}},{type:N(r.kind)});return{criticalNames:s,registry:e}},_=(t,e)=>{const s=t.includes(":")?t.slice(0,t.indexOf(":")):"probe",r=(e.get(s)??0)+1;return e.set(s,r),r===1?s:`${s}#${String(r)}`},j=(t,e)=>t?"unhealthy":e?"degraded":"healthy",M=(t,e,s,r,a)=>{const o=[];let u=!1,d=!1;const y=new Map;for(const[h,c]of Object.entries(t)){const n=e.has(h),i=c.health.healthy;d=d||!i,u=u||!i&&n;const l=s==="admin"?h:_(h,y);o.push({critical:n,...s==="admin"&&c.health.message!==void 0?{message:c.health.message}:{},name:l,status:i?"up":"down"})}return o.sort((h,c)=>h.name<c.name?-1:+(h.name>c.name)),{anyCriticalDown:u,body:{appName:r,appVersion:a,checks:o,status:j(u,d),timestamp:new Date().toISOString()}}},G=t=>{const{appName:e="lunora",appVersion:s="0.0.0",auth:r="public",cacheTtlMs:a,isAdmin:o,resolveProbes:u}=t,d=n=>a!==void 0?a:n==="readiness"?0:r==="public"?5e3:0,y={},h=n=>{if(r==="admin"&&!o(n))throw new T("health endpoint requires a valid admin bearer",{code:"ADMIN_FORBIDDEN",status:403})},c=async(n,i,l)=>{const p=A(n,["GET","HEAD"]);if(p)return p;h(n);const f=d(l);if(f>0){const m=y[l];if(m!==void 0&&Date.now()<m.expiresAt)return Response.json(m.body,{headers:{"cache-control":"no-store"},status:m.down?503:200})}const{criticalNames:b,registry:v}=S(u(i)),{healthy:E,report:k}=await v.getReport(l==="readiness"?"readiness":void 0),{anyCriticalDown:D,body:g}=M(k,b,r,e,s),w=l==="readiness"?!E:D;return f>0&&(y[l]={body:g,down:w,expiresAt:Date.now()+f}),Response.json(g,{headers:{"cache-control":"no-store"},status:w?503:200})};return{[H]:(n,i)=>c(n,i,"aggregate"),[C]:(n,i)=>c(n,i,"readiness")}},I=(t,e,s)=>({check:async()=>{try{return await R(e,s).fetch(new Request("https://shard.internal/_lunora/status",{method:"GET"})),{healthy:!0}}catch{return{healthy:!1,message:"durable object unreachable"}}},critical:!0,name:t}),q=(t,e)=>({check:async()=>{try{return await e.prepare("SELECT 1").first(),{healthy:!0}}catch{return{healthy:!1,message:"d1 query failed"}}},critical:!0,name:t}),B=(t,e)=>({check:()=>e?{healthy:!0}:{healthy:!1,message:"binding not configured"},critical:!1,name:t});export{H as HEALTH_PATH,C as HEALTH_READY_PATH,G as buildHealthRoutes,q as d1Probe,I as durableObjectProbe,B as presenceProbe};

package/dist/packem_shared/{LOG_ARCHIVE_PATH-Hmjpz_Ko.mjs → LOG_ARCHIVE_PATH-dTuCzfyj.mjs}

@@ -1 +1 @@
-import{createR2Sql as h}from"@lunora/bindings/r2sql";import{LOG_ARCHIVE_NOT_CONFIGURED as l}from"./LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{L,c as A}from"./pipeline-log-reader-C-nuWG_e.mjs";import{LunoraError as _}from"./LunoraError-DksAgIpa.mjs";import{a as R}from"./method-guard-BG_vJNTl.mjs";const v="/_lunora/admin/logs/archive",m="LUNORA_LOG_ARCHIVE_TABLE",C="LUNORA_LOG_ARCHIVE_NAMESPACE",V=e=>{if(typeof e!="object"||e===null)return;const o=e,s=o[m];if(typeof s!="string"||s==="")return;const n=o[C];return{table:s,...typeof n=="string"&&n!==""?{namespace:n}:{}}},T=new Set(L),O=e=>typeof e=="string"&&e!==""?e:void 0,S=(e,o)=>{if(e!==void 0){if(typeof e!="string"||!T.has(e))throw new _(`logs archive: invalid \`${o}\` — expected one of ${L.join(", ")}`,{code:"BAD_REQUEST",status:400});return e}},p=(e,o)=>{if(e!==void 0){if(typeof e!="number"||!Number.isFinite(e))throw new _(`logs archive: invalid \`${o}\` — expected a finite number`,{code:"BAD_REQUEST",status:400});return e}},b=e=>{const o={},s=r=>{const t=O(e[r]);t!==void 0&&(o[r]=t)},n=r=>{const t=S(e[r],r);t!==void 0&&(o[r]=t)},i=r=>{const t=p(e[r],r);t!==void 0&&(o[r]=t)};s("functionPath"),s("functionPathPrefix"),s("traceId"),s("shardKey"),s("userId"),n("level"),n("minLevel"),i("sinceTs"),i("untilTs"),i("limit");const c=e.cursor;if(typeof c=="object"&&c!==null){const r=c,t=p(r.ts,"cursor.ts");if(t!==void 0){const a=r.seen;if(a!==void 0&&(!Array.isArray(a)||a.some(d=>typeof d!="string")))throw new _("logs archive: invalid `cursor.seen` — expected an array of strings",{code:"BAD_REQUEST",status:400});const u=a;o.cursor=u===void 0||u.length===0?{ts:t}:{seen:u,ts:t}}}return o},y=e=>{const o=e.R2_SQL_ACCOUNT_ID??e.CLOUDFLARE_ACCOUNT_ID,s=e.R2_SQL_TOKEN,n=e.R2_SQL_BUCKET,i=[];if((o===void 0||o==="")&&i.push("R2_SQL_ACCOUNT_ID"),(s===void 0||s==="")&&i.push("R2_SQL_TOKEN"),(n===void 0||n==="")&&i.push("R2_SQL_BUCKET"),i.length>0)throw new _(`log archive not configured (missing ${i.join(", ")}). The Pipeline must write to an R2 Data Catalog (Iceberg) table, and R2_SQL_ACCOUNT_ID / R2_SQL_TOKEN / R2_SQL_BUCKET must be set — see the observability docs.`,{code:l,status:400});return{accountId:o,apiToken:s,bucket:n}},B=e=>{const{createReader:o=A,readJsonBody:s,requireAdminOption:n}=e,i=async(c,r)=>{R(c,"POST","Log-archive");const t=n(c,e.logArchive,{code:l,message:"log archive requires a `logArchive` config (an R2 Data Catalog table) on the worker — see the observability docs"}),{accountId:a,apiToken:u,bucket:d}=y(r??{}),g=b(await s(c)),E=h({accountId:a,apiToken:u,bucket:d}),f=await o(E,{columnMap:t.columnMap,namespace:t.namespace,table:t.table}).query(g);return Response.json(f,{headers:{"content-type":"application/json"},status:200})};return{[v]:i}};export{l as LOG_ARCHIVE_NOT_CONFIGURED,v as LOG_ARCHIVE_PATH,B as buildLogArchiveAdminRoutes,V as resolveLogArchiveFromEnv};
+import{createR2Sql as h}from"@lunora/bindings/r2sql";import{LOG_ARCHIVE_NOT_CONFIGURED as l}from"./LOG_ARCHIVE_NOT_CONFIGURED-CDpi4yFD.mjs";import{L,c as A}from"./pipeline-log-reader-C-nuWG_e.mjs";import{LunoraError as _}from"./LunoraError-PkZWF-_g.mjs";import{a as R}from"./method-guard-8Jo4Q8uS.mjs";const v="/_lunora/admin/logs/archive",m="LUNORA_LOG_ARCHIVE_TABLE",C="LUNORA_LOG_ARCHIVE_NAMESPACE",V=e=>{if(typeof e!="object"||e===null)return;const o=e,s=o[m];if(typeof s!="string"||s==="")return;const n=o[C];return{table:s,...typeof n=="string"&&n!==""?{namespace:n}:{}}},T=new Set(L),O=e=>typeof e=="string"&&e!==""?e:void 0,S=(e,o)=>{if(e!==void 0){if(typeof e!="string"||!T.has(e))throw new _(`logs archive: invalid \`${o}\` — expected one of ${L.join(", ")}`,{code:"BAD_REQUEST",status:400});return e}},p=(e,o)=>{if(e!==void 0){if(typeof e!="number"||!Number.isFinite(e))throw new _(`logs archive: invalid \`${o}\` — expected a finite number`,{code:"BAD_REQUEST",status:400});return e}},b=e=>{const o={},s=r=>{const t=O(e[r]);t!==void 0&&(o[r]=t)},n=r=>{const t=S(e[r],r);t!==void 0&&(o[r]=t)},i=r=>{const t=p(e[r],r);t!==void 0&&(o[r]=t)};s("functionPath"),s("functionPathPrefix"),s("traceId"),s("shardKey"),s("userId"),n("level"),n("minLevel"),i("sinceTs"),i("untilTs"),i("limit");const c=e.cursor;if(typeof c=="object"&&c!==null){const r=c,t=p(r.ts,"cursor.ts");if(t!==void 0){const a=r.seen;if(a!==void 0&&(!Array.isArray(a)||a.some(d=>typeof d!="string")))throw new _("logs archive: invalid `cursor.seen` — expected an array of strings",{code:"BAD_REQUEST",status:400});const u=a;o.cursor=u===void 0||u.length===0?{ts:t}:{seen:u,ts:t}}}return o},y=e=>{const o=e.R2_SQL_ACCOUNT_ID??e.CLOUDFLARE_ACCOUNT_ID,s=e.R2_SQL_TOKEN,n=e.R2_SQL_BUCKET,i=[];if((o===void 0||o==="")&&i.push("R2_SQL_ACCOUNT_ID"),(s===void 0||s==="")&&i.push("R2_SQL_TOKEN"),(n===void 0||n==="")&&i.push("R2_SQL_BUCKET"),i.length>0)throw new _(`log archive not configured (missing ${i.join(", ")}). The Pipeline must write to an R2 Data Catalog (Iceberg) table, and R2_SQL_ACCOUNT_ID / R2_SQL_TOKEN / R2_SQL_BUCKET must be set — see the observability docs.`,{code:l,status:400});return{accountId:o,apiToken:s,bucket:n}},B=e=>{const{createReader:o=A,readJsonBody:s,requireAdminOption:n}=e,i=async(c,r)=>{R(c,"POST","Log-archive");const t=n(c,e.logArchive,{code:l,message:"log archive requires a `logArchive` config (an R2 Data Catalog table) on the worker — see the observability docs"}),{accountId:a,apiToken:u,bucket:d}=y(r??{}),g=b(await s(c)),E=h({accountId:a,apiToken:u,bucket:d}),f=await o(E,{columnMap:t.columnMap,namespace:t.namespace,table:t.table}).query(g);return Response.json(f,{headers:{"content-type":"application/json"},status:200})};return{[v]:i}};export{l as LOG_ARCHIVE_NOT_CONFIGURED,v as LOG_ARCHIVE_PATH,B as buildLogArchiveAdminRoutes,V as resolveLogArchiveFromEnv};

package/dist/packem_shared/{LunoraError-DksAgIpa.mjs → LunoraError-PkZWF-_g.mjs}

@@ -1 +1 @@
-import{LunoraError as t,toErrorBody as a}from"@lunora/errors";const n=e=>{const{body:o,redacted:r,status:s}=a(e,{fallbackCode:"INTERNAL",redactedMessage:"Internal error"});return r&&console.error("[lunora] internal error:",e),Response.json({error:o},{headers:{"content-type":"application/json"},status:s})};class u extends t{constructor(o,r){super(r?.code??"INTERNAL",o,{cause:r?.cause,status:r?.status})}toResponse(){return n(this)}}export{u as LunoraError,n as toErrorResponse};
+import{LunoraError as t,toErrorBody as a}from"@lunora/errors";const n=e=>{const{body:o,redacted:r,status:s}=a(e,{fallbackCode:"INTERNAL",redactedMessage:"Internal error"});return r&&console.error("[lunora] internal error:",e),Response.json({error:o},{headers:{"content-type":"application/json"},status:s})};class u extends t{constructor(o,r){super(r?.code??"INTERNAL",o,{cause:r?.cause,internal:r?.internal,status:r?.status,why:r?.why})}toResponse(){return n(this)}}export{u as LunoraError,n as toErrorResponse};

package/dist/packem_shared/{STORAGE_UPLOAD_MAX_BODY_BYTES-BIiV5kqV.mjs → STORAGE_UPLOAD_MAX_BODY_BYTES-DiZho96u.mjs}

@@ -1 +1 @@
-import{LunoraError as i}from"./LunoraError-DksAgIpa.mjs";import{a as O}from"./method-guard-BG_vJNTl.mjs";const j="/_lunora/admin/storage",P="/_lunora/admin/storage/object",B="/_lunora/admin/storage/url",C="/_lunora/admin/storage/buckets",v=10080*60,I=32*1048576,M=new Set(["GET","PUT"]),x=E=>{const w=new Uint8Array(E);let T="";for(const s of w)T+=s.toString(16).padStart(2,"0");return T},z=E=>{const{assertAdmin:w,parsePaging:T,queryParameter:s,readBodyBytes:R,requireAdminOption:d,storage:r}=E,h=e=>{const o=s(e,"key");if(o===void 0)throw new i("Storage endpoint requires a `key` query parameter",{code:"BAD_REQUEST",status:400});return o},u=e=>{const o=s(e,"bucket"),t=r.storageBuckets;if(o===void 0||t===void 0||t.length===0)return o;if(!t.includes(o))throw new i(`Unknown storage bucket \`${o}\``,{code:"NOT_FOUND",status:404});return o},U=async e=>{const o=d(e,r.storageList,{code:"STORAGE_NOT_CONFIGURED",message:"storage endpoint requires a `storageList` function on the worker"}),t=new URL(e.url),n=await o(s(t,"prefix"),{bucket:u(t),cursor:s(t,"cursor"),...T(e)});return Response.json(n,{headers:{"content-type":"application/json"},status:200})},m=e=>(O(e,"GET","Storage-buckets"),w(e),Response.json({buckets:r.storageBuckets??[]},{headers:{"content-type":"application/json"},status:200})),A=async e=>{const o=d(e,r.storageDelete,{code:"STORAGE_DELETE_NOT_CONFIGURED",message:"storage delete requires a `storageDelete` function on the worker"}),t=new URL(e.url),n=h(t);return await o(n,{bucket:u(t)}),Response.json({deleted:!0,key:n},{headers:{"content-type":"application/json"},status:200})},k=async e=>{const o=d(e,r.storageUpload,{code:"STORAGE_UPLOAD_NOT_CONFIGURED",message:"storage upload requires a `storageUpload` function on the worker"}),t=new URL(e.url),n=h(t),a=u(t),g=await R(e,I),c=e.headers.get("content-type"),_=c===null||c===""?void 0:c,l=s(t,"expectedSha256"),p=s(t,"expectedSize");let S;if(l!==void 0||p!==void 0){const L=await crypto.subtle.digest("SHA-256",g);S=x(L);const N=p!==void 0&&g.byteLength!==Number(p),f=l!==void 0&&S!==l.toLowerCase();if(N||f)throw new i("Upload failed verification — the body did not match the declared size or SHA-256 checksum, so nothing was written",{code:"STORAGE_CHECKSUM_MISMATCH",status:400})}const y=await o(n,g,{bucket:a,contentType:_,sha256:S});return Response.json(S===void 0?y:{...y,sha256:S},{headers:{"content-type":"application/json"},status:200})},b=async e=>{switch(e.method){case"DELETE":return A(e);case"GET":return U(e);case"POST":case"PUT":return k(e);default:throw new i("Storage endpoint requires GET, PUT, POST, or DELETE",{code:"METHOD_NOT_ALLOWED",status:405})}},D=async e=>{O(e,"GET","Storage-object");const o=d(e,r.storageDownload,{code:"STORAGE_DOWNLOAD_NOT_CONFIGURED",message:"storage download requires a `storageDownload` function on the worker"}),t=new URL(e.url),n=h(t),a=await o(n,{bucket:u(t)});if(!a?.body)throw new i(`No object at key ${n}`,{code:"STORAGE_OBJECT_NOT_FOUND",status:404});return new Response(a.body,{headers:{"content-disposition":"attachment","content-type":a.httpMetadata?.contentType??"application/octet-stream","x-content-type-options":"nosniff",...a.size===void 0?{}:{"content-length":String(a.size)}},status:200})},G=async e=>{O(e,"GET","Storage URL");const o=d(e,r.storageSignedUrl,{code:"STORAGE_URL_NOT_CONFIGURED",message:"storage URL endpoint requires a `storageSignedUrl` function on the worker"}),t=new URL(e.url),n=h(t),a=Number(s(t,"expiresIn")??""),g=Number.isFinite(a)&&a>0?Math.min(a,v):void 0,c=s(t,"method");if(c!==void 0&&!M.has(c))throw new i("Storage URL `method` must be GET or PUT",{code:"BAD_REQUEST",status:400});const _=c,l=s(t,"contentType"),p=await o(n,{bucket:u(t),contentType:l,expiresInSeconds:g,method:_,origin:t.origin});return Response.json({key:n,url:p},{headers:{"content-type":"application/json"},status:200})};return{[C]:m,[P]:D,[j]:b,[B]:G}};export{C as STORAGE_BUCKETS_PATH,j as STORAGE_PATH,I as STORAGE_UPLOAD_MAX_BODY_BYTES,B as STORAGE_URL_PATH,z as buildStorageAdminRoutes,x as toHex};
+import{LunoraError as i}from"./LunoraError-PkZWF-_g.mjs";import{a as O}from"./method-guard-8Jo4Q8uS.mjs";const j="/_lunora/admin/storage",P="/_lunora/admin/storage/object",B="/_lunora/admin/storage/url",C="/_lunora/admin/storage/buckets",v=10080*60,I=32*1048576,M=new Set(["GET","PUT"]),x=E=>{const w=new Uint8Array(E);let T="";for(const s of w)T+=s.toString(16).padStart(2,"0");return T},z=E=>{const{assertAdmin:w,parsePaging:T,queryParameter:s,readBodyBytes:R,requireAdminOption:d,storage:r}=E,h=e=>{const o=s(e,"key");if(o===void 0)throw new i("Storage endpoint requires a `key` query parameter",{code:"BAD_REQUEST",status:400});return o},u=e=>{const o=s(e,"bucket"),t=r.storageBuckets;if(o===void 0||t===void 0||t.length===0)return o;if(!t.includes(o))throw new i(`Unknown storage bucket \`${o}\``,{code:"NOT_FOUND",status:404});return o},U=async e=>{const o=d(e,r.storageList,{code:"STORAGE_NOT_CONFIGURED",message:"storage endpoint requires a `storageList` function on the worker"}),t=new URL(e.url),n=await o(s(t,"prefix"),{bucket:u(t),cursor:s(t,"cursor"),...T(e)});return Response.json(n,{headers:{"content-type":"application/json"},status:200})},m=e=>(O(e,"GET","Storage-buckets"),w(e),Response.json({buckets:r.storageBuckets??[]},{headers:{"content-type":"application/json"},status:200})),A=async e=>{const o=d(e,r.storageDelete,{code:"STORAGE_DELETE_NOT_CONFIGURED",message:"storage delete requires a `storageDelete` function on the worker"}),t=new URL(e.url),n=h(t);return await o(n,{bucket:u(t)}),Response.json({deleted:!0,key:n},{headers:{"content-type":"application/json"},status:200})},k=async e=>{const o=d(e,r.storageUpload,{code:"STORAGE_UPLOAD_NOT_CONFIGURED",message:"storage upload requires a `storageUpload` function on the worker"}),t=new URL(e.url),n=h(t),a=u(t),g=await R(e,I),c=e.headers.get("content-type"),_=c===null||c===""?void 0:c,l=s(t,"expectedSha256"),p=s(t,"expectedSize");let S;if(l!==void 0||p!==void 0){const L=await crypto.subtle.digest("SHA-256",g);S=x(L);const N=p!==void 0&&g.byteLength!==Number(p),f=l!==void 0&&S!==l.toLowerCase();if(N||f)throw new i("Upload failed verification — the body did not match the declared size or SHA-256 checksum, so nothing was written",{code:"STORAGE_CHECKSUM_MISMATCH",status:400})}const y=await o(n,g,{bucket:a,contentType:_,sha256:S});return Response.json(S===void 0?y:{...y,sha256:S},{headers:{"content-type":"application/json"},status:200})},b=async e=>{switch(e.method){case"DELETE":return A(e);case"GET":return U(e);case"POST":case"PUT":return k(e);default:throw new i("Storage endpoint requires GET, PUT, POST, or DELETE",{code:"METHOD_NOT_ALLOWED",status:405})}},D=async e=>{O(e,"GET","Storage-object");const o=d(e,r.storageDownload,{code:"STORAGE_DOWNLOAD_NOT_CONFIGURED",message:"storage download requires a `storageDownload` function on the worker"}),t=new URL(e.url),n=h(t),a=await o(n,{bucket:u(t)});if(!a?.body)throw new i(`No object at key ${n}`,{code:"STORAGE_OBJECT_NOT_FOUND",status:404});return new Response(a.body,{headers:{"content-disposition":"attachment","content-type":a.httpMetadata?.contentType??"application/octet-stream","x-content-type-options":"nosniff",...a.size===void 0?{}:{"content-length":String(a.size)}},status:200})},G=async e=>{O(e,"GET","Storage URL");const o=d(e,r.storageSignedUrl,{code:"STORAGE_URL_NOT_CONFIGURED",message:"storage URL endpoint requires a `storageSignedUrl` function on the worker"}),t=new URL(e.url),n=h(t),a=Number(s(t,"expiresIn")??""),g=Number.isFinite(a)&&a>0?Math.min(a,v):void 0,c=s(t,"method");if(c!==void 0&&!M.has(c))throw new i("Storage URL `method` must be GET or PUT",{code:"BAD_REQUEST",status:400});const _=c,l=s(t,"contentType"),p=await o(n,{bucket:u(t),contentType:l,expiresInSeconds:g,method:_,origin:t.origin});return Response.json({key:n,url:p},{headers:{"content-type":"application/json"},status:200})};return{[C]:m,[P]:D,[j]:b,[B]:G}};export{C as STORAGE_BUCKETS_PATH,j as STORAGE_PATH,I as STORAGE_UPLOAD_MAX_BODY_BYTES,B as STORAGE_URL_PATH,z as buildStorageAdminRoutes,x as toHex};

package/dist/packem_shared/analyticsEngineSink-s5j-3P1X.mjs

@@ -0,0 +1 @@
+import"./otlp-resource-Ch_8_U0e.mjs";import{S as a,a as s,c as S,b as e,o as k,p,w as c}from"./observability-sinks-lLKqc_rV.mjs";export{a as SINK_CONFIG_FIELDS,s as analyticsEngineSink,S as combineSinks,e as consoleSink,k as otlpSink,p as pipelineLogSink,c as webhookSink};

package/dist/packem_shared/{applyJurisdiction-D4vryLhj.mjs → applyJurisdiction-DKQE8kOA.mjs}

@@ -1 +1 @@
-import{LUNORA_ROLE_PREFIX as d,resolveShard as f}from"@lunora/platform";import{LunoraError as m}from"./LunoraError-DksAgIpa.mjs";const a=new WeakMap,n=e=>e===void 0?void 0:{locationHint:e},p=e=>typeof e.idFromName=="function",u=e=>{if(!p(e))return e;const o=e,i=a.get(e);if(i!==void 0)return i;const s=typeof o.jurisdiction=="function"?r=>u(o.jurisdiction(r)):void 0,c=typeof o.getByName=="function"?{get:(r,t)=>o.get(r,n(t)),getByName:(r,t)=>o.getByName(r,n(t)),idForName:r=>o.idFromName(r),jurisdiction:s}:{get:(r,t)=>o.get(r,n(t)),idForName:r=>o.idFromName(r),jurisdiction:s};return a.set(e,c),c},g=(e,o)=>{if(o===void 0)return e;if(typeof e.jurisdiction!="function")throw new TypeError(`@lunora/runtime: Durable Object namespace does not support jurisdiction("${o}") — update @cloudflare/workers-types or remove the jurisdiction option`);return e.jurisdiction(o)},h=(e,o,i)=>{if(o.startsWith(d))throw new m(`shard key "${o}" uses the reserved "${d}" prefix`,{code:"BAD_REQUEST",status:400});return f(u(e),o,i)};export{g as applyJurisdiction,h as resolveShard};
+import{LUNORA_ROLE_PREFIX as d,resolveShard as f}from"@lunora/platform";import{LunoraError as m}from"./LunoraError-PkZWF-_g.mjs";const a=new WeakMap,n=e=>e===void 0?void 0:{locationHint:e},p=e=>typeof e.idFromName=="function",u=e=>{if(!p(e))return e;const o=e,i=a.get(e);if(i!==void 0)return i;const s=typeof o.jurisdiction=="function"?r=>u(o.jurisdiction(r)):void 0,c=typeof o.getByName=="function"?{get:(r,t)=>o.get(r,n(t)),getByName:(r,t)=>o.getByName(r,n(t)),idForName:r=>o.idFromName(r),jurisdiction:s}:{get:(r,t)=>o.get(r,n(t)),idForName:r=>o.idFromName(r),jurisdiction:s};return a.set(e,c),c},g=(e,o)=>{if(o===void 0)return e;if(typeof e.jurisdiction!="function")throw new TypeError(`@lunora/runtime: Durable Object namespace does not support jurisdiction("${o}") — update @cloudflare/workers-types or remove the jurisdiction option`);return e.jurisdiction(o)},h=(e,o,i)=>{if(o.startsWith(d))throw new m(`shard key "${o}" uses the reserved "${d}" prefix`,{code:"BAD_REQUEST",status:400});return f(u(e),o,i)};export{g as applyJurisdiction,h as resolveShard};

package/dist/packem_shared/argsFromQuery-C8Ox3sr1.mjs

@@ -0,0 +1 @@
+import{a as o,b as i,c as m,r as R}from"./rest-routes-CDQ1F7kI.mjs";import"./rest-cache-CmHN871W.mjs";import"./LunoraError-PkZWF-_g.mjs";import"./method-guard-8Jo4Q8uS.mjs";export{o as argsFromQuery,i as buildRestRoutes,m as createRestRateLimit,R as restSurfaceFromRegistry};

package/dist/packem_shared/{composeIdentityResolvers-BHZ4jH8o.mjs → composeIdentityResolvers-CpdHuDyk.mjs}

@@ -1 +1 @@
-import{LunoraError as a}from"./LunoraError-DksAgIpa.mjs";const u=(t,o={})=>{const r=o.onError??"fail-closed";return async(n,c,e)=>{for(const s of t){let i;try{i=await s(n,c,e)}catch(l){if(r==="skip")continue;throw l}if(i)return i}return null}},f=t=>{const o=Object.keys(t).filter(r=>r!=="*").toSorted((r,n)=>n.length-r.length);return(r,n,c)=>{const{pathname:e}=new URL(r.url),s=o.find(l=>e===l||e.startsWith(l.endsWith("/")?l:`${l}/`)),i=s===void 0?t["*"]:t[s];return i===void 0?null:i(r,n,c)}},h=(t,o)=>o===void 0||t===void 0?t:async(r,n,c)=>{const e=await t(r,n,c);if(!e)return e;const s=o.validate(e);if(s.ok)return e;if(o.onInvalid==="reject")throw new a(`identity claims failed the declared contract: ${s.error}`,{code:"UNAUTHENTICATED",status:401});return null};export{u as composeIdentityResolvers,f as routeIdentityResolvers,h as wrapResolverWithContract};
+import{LunoraError as a}from"./LunoraError-PkZWF-_g.mjs";const u=(t,o={})=>{const r=o.onError??"fail-closed";return async(n,c,e)=>{for(const s of t){let i;try{i=await s(n,c,e)}catch(l){if(r==="skip")continue;throw l}if(i)return i}return null}},f=t=>{const o=Object.keys(t).filter(r=>r!=="*").toSorted((r,n)=>n.length-r.length);return(r,n,c)=>{const{pathname:e}=new URL(r.url),s=o.find(l=>e===l||e.startsWith(l.endsWith("/")?l:`${l}/`)),i=s===void 0?t["*"]:t[s];return i===void 0?null:i(r,n,c)}},h=(t,o)=>o===void 0||t===void 0?t:async(r,n,c)=>{const e=await t(r,n,c);if(!e)return e;const s=o.validate(e);if(s.ok)return e;if(o.onInvalid==="reject")throw new a(`identity claims failed the declared contract: ${s.error}`,{code:"UNAUTHENTICATED",status:401});return null};export{u as composeIdentityResolvers,f as routeIdentityResolvers,h as wrapResolverWithContract};