@lunora/runtime 1.0.0-alpha.25 → 1.0.0-alpha.27

package/dist/index.d.mts

@@ -682,6 +682,16 @@ interface ObservabilityEvent {
   ok: boolean;
   /** Shard key for single-shard calls; absent for fan-outs. */
   shardKey?: string;
+  /**
+  * W3C trace context for this dispatch, generated once at dispatch entry (32-
+  * and 16-hex). A sink (e.g. `otlpSink`) reuses these for the dispatch's span
+  * instead of minting fresh ids, and the runtime propagates them to the shard
+  * as a `traceparent` so a container the handler calls can stitch its spans
+  * under the same trace. Absent on paths that don't originate a trace (a sink
+  * falls back to random ids).
+  */
+  spanId?: string;
+  traceId?: string;
 }
 /** Severity of a {@link LogEvent}, mirroring the usual console levels. */
 type LogLevel = "debug" | "error" | "info" | "log" | "warn";
@@ -2338,6 +2348,17 @@ interface WorkerOptions {
   */
   vectorIntrospector?: VectorIntrospector;
   /**
+  * Voice-session Durable Object namespaces, keyed by the agent's
+  * `lunora/agents.ts` export name (e.g. `{ support: env.VOICE_SUPPORT }`).
+  * Codegen wires this for every voice-enabled agent. When set, the worker
+  * exposes `/_lunora/voice/<agentExportName>` — a WebSocket upgrade that
+  * resolves the caller's identity, forwards it on the server-minted
+  * `x-lunora-userid` / `x-lunora-identity` headers, and hands the socket to
+  * the agent's `VoiceSessionDO`. Omit it (voice-free apps) and the route does
+  * not exist.
+  */
+  voiceAgents?: Record<string, ShardNamespaceLike>;
+  /**
   * Resolver for the Cloudflare Workflows REST client, built from the
   * deployment `env` (its `CLOUDFLARE_ACCOUNT_ID` / `CLOUDFLARE_API_TOKEN`).
   * Set by the codegen-emitted worker entry (which depends on

package/dist/index.d.ts

@@ -682,6 +682,16 @@ interface ObservabilityEvent {
   ok: boolean;
   /** Shard key for single-shard calls; absent for fan-outs. */
   shardKey?: string;
+  /**
+  * W3C trace context for this dispatch, generated once at dispatch entry (32-
+  * and 16-hex). A sink (e.g. `otlpSink`) reuses these for the dispatch's span
+  * instead of minting fresh ids, and the runtime propagates them to the shard
+  * as a `traceparent` so a container the handler calls can stitch its spans
+  * under the same trace. Absent on paths that don't originate a trace (a sink
+  * falls back to random ids).
+  */
+  spanId?: string;
+  traceId?: string;
 }
 /** Severity of a {@link LogEvent}, mirroring the usual console levels. */
 type LogLevel = "debug" | "error" | "info" | "log" | "warn";
@@ -2338,6 +2348,17 @@ interface WorkerOptions {
   */
   vectorIntrospector?: VectorIntrospector;
   /**
+  * Voice-session Durable Object namespaces, keyed by the agent's
+  * `lunora/agents.ts` export name (e.g. `{ support: env.VOICE_SUPPORT }`).
+  * Codegen wires this for every voice-enabled agent. When set, the worker
+  * exposes `/_lunora/voice/<agentExportName>` — a WebSocket upgrade that
+  * resolves the caller's identity, forwards it on the server-minted
+  * `x-lunora-userid` / `x-lunora-identity` headers, and hands the socket to
+  * the agent's `VoiceSessionDO`. Omit it (voice-free apps) and the route does
+  * not exist.
+  */
+  voiceAgents?: Record<string, ShardNamespaceLike>;
+  /**
   * Resolver for the Cloudflare Workflows REST client, built from the
   * deployment `env` (its `CLOUDFLARE_ACCOUNT_ID` / `CLOUDFLARE_API_TOKEN`).
   * Set by the codegen-emitted worker entry (which depends on

package/dist/index.mjs

@@ -1,10 +1,10 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-CxwkPZUl.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-UZKPkF3Q.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';
 export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK8.mjs';
-export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-BpJlA7e9.mjs';
+export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-F-5ZAdUA.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-DNCJzOZE.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
 export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DRWQFNhF.mjs';

package/dist/packem_shared/{analyticsEngineSink-BpJlA7e9.mjs → analyticsEngineSink-F-5ZAdUA.mjs}

@@ -1,81 +1,4 @@
-const OTLP_SEVERITY = {
-  debug: 5,
-  // DEBUG
-  error: 17,
-  // ERROR
-  info: 9,
-  // INFO
-  log: 9,
-  // INFO
-  warn: 13
-  // WARN
-};
-const otlpUnixNano = (ms) => `${String(Math.round(ms))}000000`;
-const otlpRandomHex = (bytes) => {
-  const buffer = new Uint8Array(bytes);
-  crypto.getRandomValues(buffer);
-  let hex = "";
-  for (const byte of buffer) {
-    hex += byte.toString(16).padStart(2, "0");
-  }
-  return hex;
-};
-const encodeAttribute = (key, value) => {
-  if (typeof value === "boolean") {
-    return { key, value: { boolValue: value } };
-  }
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) {
-      return { key, value: { stringValue: String(value) } };
-    }
-    return Number.isSafeInteger(value) ? { key, value: { intValue: String(value) } } : { key, value: { doubleValue: value } };
-  }
-  return { key, value: { stringValue: value } };
-};
-const mergeHeaders = (defaults, overrides, token) => {
-  const merged = {};
-  const seen = /* @__PURE__ */ new Map();
-  const put = (name, value) => {
-    const lower = name.toLowerCase();
-    const existing = seen.get(lower);
-    if (existing === void 0) {
-      seen.set(lower, name);
-      merged[name] = value;
-    } else {
-      merged[existing] = value;
-    }
-  };
-  for (const [name, value] of Object.entries(defaults)) {
-    put(name, value);
-  }
-  for (const [name, value] of Object.entries(overrides ?? {})) {
-    put(name, value);
-  }
-  if (token !== void 0 && token.length > 0) {
-    put("authorization", `Bearer ${token}`);
-  }
-  return merged;
-};
-const wrapResourceSpans = (span, scopeName, serviceName) => {
-  return {
-    resourceSpans: [
-      {
-        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
-        scopeSpans: [{ scope: { name: scopeName }, spans: [span] }]
-      }
-    ]
-  };
-};
-const wrapResourceLogs = (logRecord, scopeName, serviceName) => {
-  return {
-    resourceLogs: [
-      {
-        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
-        scopeLogs: [{ logRecords: [logRecord], scope: { name: scopeName } }]
-      }
-    ]
-  };
-};
+import { m as mergeHeaders, o as otlpRandomHex, w as wrapResourceSpans, a as wrapResourceLogs, e as encodeAttribute, O as OTLP_SEVERITY, c as otlpUnixNano } from './otlp-D_YzGXu1.mjs';
 
 const shouldSkip = (event, onlyErrors) => onlyErrors === true && event.ok;
 const otlpTraceBody = (event, serviceName, endMs) => {
@@ -99,11 +22,13 @@ const otlpTraceBody = (event, serviceName, endMs) => {
     // SPAN_KIND_SERVER — a dispatched RPC is server-side request handling.
     kind: 2,
     name: event.functionPath,
-    spanId: otlpRandomHex(8),
+    // Reuse the dispatch's trace context when the runtime set it (so this span
+    // shares the id it propagated as `traceparent`); else mint fresh ids.
+    spanId: event.spanId ?? otlpRandomHex(8),
     startTimeUnixNano: otlpUnixNano(endMs - event.durationMs),
     // STATUS_CODE_OK (1) / STATUS_CODE_ERROR (2).
     status: event.ok ? { code: 1 } : { code: 2, message: event.error?.message ?? "" },
-    traceId: otlpRandomHex(16)
+    traceId: event.traceId ?? otlpRandomHex(16)
   };
   return wrapResourceSpans(span, "@lunora/runtime", serviceName);
 };

package/dist/packem_shared/{composeWorker-CxwkPZUl.mjs → composeWorker-UZKPkF3Q.mjs}

@@ -1,5 +1,6 @@
 import { isLunoraError, toErrorBody } from '@lunora/errors';
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
+import { o as otlpRandomHex, b as buildTraceparent } from './otlp-D_YzGXu1.mjs';
 import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
 import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
@@ -1916,12 +1917,24 @@ const NDJSON_ENCODER = new TextEncoder();
 const RPC_PATH = "/_lunora/rpc";
 const RPC_BATCH_PATH = "/_lunora/rpc-batch";
 const WS_PATH = "/_lunora/ws";
+const VOICE_PATH_PREFIX = "/_lunora/voice/";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
 const ADMIN_PATH_PREFIX = "/_lunora/admin/";
 const MIGRATE_PATH = "/_lunora/migrate";
 const STATUS_PATH = "/_lunora/status";
 const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
+const readForwardedIdentity = (request) => {
+  const forwardedUserId = request.headers.get("x-lunora-userid");
+  const forwardedIdentity = request.headers.get("x-lunora-identity");
+  if (forwardedUserId === null && forwardedIdentity === null) {
+    return void 0;
+  }
+  return {
+    ...forwardedIdentity === null ? {} : { identity: forwardedIdentity },
+    ...forwardedUserId === null ? {} : { userId: forwardedUserId }
+  };
+};
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
@@ -2239,7 +2252,7 @@ const createWorker = (options) => {
     resolveForwardContext: resolveAdminForwardContext,
     shardDO
   });
-  const dispatchToShard = async (functionPath, args, shardKey, mutationId) => {
+  const dispatchToShard = async (functionPath, args, shardKey, mutationId, forwardedIdentity) => {
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(null, shardKey);
       if (!allowed) {
@@ -2247,6 +2260,12 @@ const createWorker = (options) => {
       }
     }
     const headers = { "content-type": "application/json", "x-lunora-system": "1" };
+    if (forwardedIdentity?.userId !== void 0 && forwardedIdentity.userId.length > 0) {
+      headers["x-lunora-userid"] = forwardedIdentity.userId;
+    }
+    if (forwardedIdentity?.identity !== void 0 && forwardedIdentity.identity.length > 0) {
+      headers["x-lunora-identity"] = forwardedIdentity.identity;
+    }
     if (mutationId !== void 0 && mutationId.length > 0) {
       headers["x-lunora-mutation-id"] = mutationId;
     }
@@ -2257,16 +2276,17 @@ const createWorker = (options) => {
     });
     return forwardToShard(shardDO, shardKey, forwarded);
   };
-  const startCronWorkflow = async (binding, job, env) => {
+  const startWorkflowInstance = async (binding, args, env, label) => {
     const candidate = env?.[binding];
     if (!candidate || typeof candidate.create !== "function") {
-      throw new LunoraError(`cron job "${job.name}" targets workflow binding "${binding}", which is not bound on env`, {
+      throw new LunoraError(`${label} targets workflow binding "${binding}", which is not bound on env`, {
         code: "CRON_JOB_FAILED",
         status: 500
       });
     }
-    await candidate.create({ params: job.args ?? {} });
+    await candidate.create({ params: args });
   };
+  const startCronWorkflow = async (binding, job, env) => startWorkflowInstance(binding, job.args ?? {}, env, `cron job "${job.name}"`);
   const runOneCronJob = async (job, env) => {
     if (job.workflow) {
       await startCronWorkflow(job.workflow, job, env);
@@ -2363,13 +2383,18 @@ const createWorker = (options) => {
       throw new LunoraError("Scheduler dispatch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
     }
     const candidate = body ?? {};
+    const args = candidate.args ?? {};
+    if (typeof candidate.workflow === "string" && candidate.workflow.length > 0) {
+      await startWorkflowInstance(candidate.workflow, args, env, "scheduled workflow");
+      return Response.json({ ok: true }, { status: 200 });
+    }
     if (typeof candidate.functionPath !== "string" || candidate.functionPath.length === 0) {
       throw new LunoraError("Scheduler dispatch is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
     }
-    const args = candidate.args ?? {};
     const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
     const mutationId = typeof candidate.id === "string" && candidate.id.length > 0 ? candidate.id : void 0;
-    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId);
+    const identity = readForwardedIdentity(request);
+    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId, identity);
     await releasePoolSlot(candidate);
     return response;
   };
@@ -2562,6 +2587,59 @@ const createWorker = (options) => {
     }
     return forwardToShard(shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
   };
+  const handleVoiceUpgrade = async (request, env, url) => {
+    const { voiceAgents } = options;
+    if (voiceAgents === void 0) {
+      return new Response("Not found", { status: 404 });
+    }
+    if (request.headers.get("Upgrade") !== "websocket") {
+      return new Response("Expected a WebSocket upgrade", { headers: { allow: "GET" }, status: 426 });
+    }
+    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
+    if (blockedUpgrade) {
+      return blockedUpgrade;
+    }
+    let agentName;
+    try {
+      agentName = decodeURIComponent(url.pathname.slice(VOICE_PATH_PREFIX.length));
+    } catch {
+      return new Response("Unknown voice agent", { status: 404 });
+    }
+    const namespace = Object.hasOwn(voiceAgents, agentName) ? voiceAgents[agentName] : void 0;
+    if (namespace === void 0) {
+      return new Response("Unknown voice agent", { status: 404 });
+    }
+    const threadKey = url.searchParams.get("threadKey");
+    if (threadKey === null || threadKey.length === 0) {
+      return new Response("Missing threadKey", { status: 400 });
+    }
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
+    if (options.authorizeShard) {
+      const allowed = await options.authorizeShard(identity, threadKey);
+      if (!allowed) {
+        return new Response("Forbidden", { status: 403 });
+      }
+    } else {
+      guardUnauthenticatedShardAccess("shard");
+    }
+    const upgradeHeaders = new Headers(request.headers);
+    upgradeHeaders.delete("x-lunora-userid");
+    upgradeHeaders.delete("x-lunora-identity");
+    upgradeHeaders.delete("x-lunora-identity-exp");
+    const forwardedUserId = forwardedHeaders["x-lunora-userid"];
+    const forwardedIdentity = forwardedHeaders["x-lunora-identity"];
+    const forwardedExp = forwardedHeaders["x-lunora-identity-exp"];
+    if (forwardedUserId !== void 0) {
+      upgradeHeaders.set("x-lunora-userid", forwardedUserId);
+    }
+    if (forwardedIdentity !== void 0) {
+      upgradeHeaders.set("x-lunora-identity", forwardedIdentity);
+    }
+    if (forwardedExp !== void 0) {
+      upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
+    }
+    return forwardToShard(namespace, threadKey, new Request(request, { headers: upgradeHeaders }));
+  };
   const authorizeFanOutEnvelope = async (fanOut, functionPath, identity) => {
     if (options.authorizeFanOut) {
       const allowed = await options.authorizeFanOut(identity, fanOut.table, functionPath);
@@ -2605,9 +2683,11 @@ const createWorker = (options) => {
   const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
     const rpcStartedAt = Date.now();
     const { observability } = options;
+    const traceId = otlpRandomHex(16);
+    const spanId = otlpRandomHex(8);
     const forwarded = new Request(`https://shard.internal/rpc`, {
       body: JSON.stringify({ args, functionPath }),
-      headers: forwardedHeaders,
+      headers: { ...forwardedHeaders, traceparent: buildTraceparent(traceId, spanId) },
       method: "POST"
     });
     try {
@@ -2619,13 +2699,15 @@ const createWorker = (options) => {
           functionPath,
           ok: response.ok,
           shardKey,
+          spanId,
+          traceId,
           ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
         },
         sinkContext
       );
       return response;
     } catch (error) {
-      emitRpcEvent(observability, buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), sinkContext);
+      emitRpcEvent(observability, { ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), spanId, traceId }, sinkContext);
       throw error;
     }
   };
@@ -3086,6 +3168,9 @@ const createWorker = (options) => {
       await applyAdminGate(request, url.pathname);
       return internalRoute(request, env, url, context);
     }
+    if (options.voiceAgents !== void 0 && url.pathname.startsWith(VOICE_PATH_PREFIX)) {
+      return handleVoiceUpgrade(request, env, url);
+    }
     const httpRouteResponse = await dispatchHttpRoute(request, env, context);
     if (httpRouteResponse) {
       return httpRouteResponse;

package/dist/packem_shared/otlp-D_YzGXu1.mjs

@@ -0,0 +1,81 @@
+const OTLP_SEVERITY = {
+  debug: 5,
+  // DEBUG
+  error: 17,
+  // ERROR
+  info: 9,
+  // INFO
+  log: 9,
+  // INFO
+  warn: 13
+  // WARN
+};
+const otlpUnixNano = (ms) => `${String(Math.round(ms))}000000`;
+const otlpRandomHex = (bytes) => {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  let hex = "";
+  for (const byte of buffer) {
+    hex += byte.toString(16).padStart(2, "0");
+  }
+  return hex;
+};
+const buildTraceparent = (traceId, spanId) => `00-${traceId}-${spanId}-01`;
+const encodeAttribute = (key, value) => {
+  if (typeof value === "boolean") {
+    return { key, value: { boolValue: value } };
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      return { key, value: { stringValue: String(value) } };
+    }
+    return Number.isSafeInteger(value) ? { key, value: { intValue: String(value) } } : { key, value: { doubleValue: value } };
+  }
+  return { key, value: { stringValue: value } };
+};
+const mergeHeaders = (defaults, overrides, token) => {
+  const merged = {};
+  const seen = /* @__PURE__ */ new Map();
+  const put = (name, value) => {
+    const lower = name.toLowerCase();
+    const existing = seen.get(lower);
+    if (existing === void 0) {
+      seen.set(lower, name);
+      merged[name] = value;
+    } else {
+      merged[existing] = value;
+    }
+  };
+  for (const [name, value] of Object.entries(defaults)) {
+    put(name, value);
+  }
+  for (const [name, value] of Object.entries(overrides ?? {})) {
+    put(name, value);
+  }
+  if (token !== void 0 && token.length > 0) {
+    put("authorization", `Bearer ${token}`);
+  }
+  return merged;
+};
+const wrapResourceSpans = (span, scopeName, serviceName) => {
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
+        scopeSpans: [{ scope: { name: scopeName }, spans: [span] }]
+      }
+    ]
+  };
+};
+const wrapResourceLogs = (logRecord, scopeName, serviceName) => {
+  return {
+    resourceLogs: [
+      {
+        resource: { attributes: [encodeAttribute("service.name", serviceName)] },
+        scopeLogs: [{ logRecords: [logRecord], scope: { name: scopeName } }]
+      }
+    ]
+  };
+};
+
+export { OTLP_SEVERITY as O, wrapResourceLogs as a, buildTraceparent as b, otlpUnixNano as c, encodeAttribute as e, mergeHeaders as m, otlpRandomHex as o, wrapResourceSpans as w };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.25",
+  "version": "1.0.0-alpha.27",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",