@lunora/runtime 1.0.0-alpha.27 → 1.0.0-alpha.28

package/dist/index.d.mts

@@ -425,13 +425,6 @@ interface AuthAdmin {
     userId: string;
   }) => Promise<AuthUser>;
 }
-/**
-* Read-only subset of {@link AuthAdmin}, kept as an alias for the former
-* `authIntrospector` option (which the worker still honours as a browse-only
-* fallback). Prefer wiring `authAdmin` with `@lunora/auth`'s `createAuthAdmin`
-* so the mutation endpoints light up too.
-*/
-type AuthIntrospector = Pick<AuthAdmin, "listSessions" | "listUsers">;
 /** Closure-scoped worker helpers the auth routes borrow (so this module stays out of the worker's god-closure). */
 /**
 * A compact, transport-safe description of one function argument — the runtime
@@ -2021,12 +2014,6 @@ interface WorkerOptions {
   */
   authHandler?: (request: Request) => Promise<Response | undefined>;
   /**
-  * @deprecated Use {@link WorkerOptions.authAdmin} (an {@link AuthAdmin}),
-  * which also lights up the user-management mutation endpoints. Still honored
-  * as a read-only fallback for the browse endpoints.
-  */
-  authIntrospector?: AuthIntrospector;
-  /**
   * Optional table-level authorization callback for fan-out RPC envelopes.
   * Called after `resolveIdentity` and before `coordinator.fanOut` walks
   * the registry. Returning `false` rejects the request with 403
@@ -2250,6 +2237,20 @@ interface WorkerOptions {
   */
   queue?: QueueConsumerHandler;
   /**
+  * Enforce the ephemeral WS admin token: when `true`,
+  * the worker's WS admin gate rejects the raw master admin token in the
+  * `?token=` query parameter — only a short-lived sub-token minted by
+  * `POST /_lunora/admin/ws-token` (or the master token in the
+  * `Authorization` HEADER, which never leaks via URLs) authorizes. Off by
+  * default (the master token in `?token=` keeps working); also settable per
+  * deployment via `env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`
+  * (`1`/`true`/`on`/`yes`/`enabled`), which the shard/relay Durable Objects
+  * honor for their own upgrade gate too. Flipping it on is the step that
+  * actually closes the URL/log leak — do so once every studio the
+  * deployment uses mints ephemeral tokens.
+  */
+  requireEphemeralWsToken?: boolean;
+  /**
   * Resolve the calling identity from the inbound RPC request. Called once
   * per RPC (and per fan-out) before the request is forwarded to the
   * shard. The returned `userId` becomes `ctx.auth.userId` on the shard
@@ -2862,4 +2863,4 @@ declare const otlpSink: (options: OtlpSinkOptions) => ObservabilitySink;
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.d.ts

@@ -425,13 +425,6 @@ interface AuthAdmin {
     userId: string;
   }) => Promise<AuthUser>;
 }
-/**
-* Read-only subset of {@link AuthAdmin}, kept as an alias for the former
-* `authIntrospector` option (which the worker still honours as a browse-only
-* fallback). Prefer wiring `authAdmin` with `@lunora/auth`'s `createAuthAdmin`
-* so the mutation endpoints light up too.
-*/
-type AuthIntrospector = Pick<AuthAdmin, "listSessions" | "listUsers">;
 /** Closure-scoped worker helpers the auth routes borrow (so this module stays out of the worker's god-closure). */
 /**
 * A compact, transport-safe description of one function argument — the runtime
@@ -2021,12 +2014,6 @@ interface WorkerOptions {
   */
   authHandler?: (request: Request) => Promise<Response | undefined>;
   /**
-  * @deprecated Use {@link WorkerOptions.authAdmin} (an {@link AuthAdmin}),
-  * which also lights up the user-management mutation endpoints. Still honored
-  * as a read-only fallback for the browse endpoints.
-  */
-  authIntrospector?: AuthIntrospector;
-  /**
   * Optional table-level authorization callback for fan-out RPC envelopes.
   * Called after `resolveIdentity` and before `coordinator.fanOut` walks
   * the registry. Returning `false` rejects the request with 403
@@ -2250,6 +2237,20 @@ interface WorkerOptions {
   */
   queue?: QueueConsumerHandler;
   /**
+  * Enforce the ephemeral WS admin token: when `true`,
+  * the worker's WS admin gate rejects the raw master admin token in the
+  * `?token=` query parameter — only a short-lived sub-token minted by
+  * `POST /_lunora/admin/ws-token` (or the master token in the
+  * `Authorization` HEADER, which never leaks via URLs) authorizes. Off by
+  * default (the master token in `?token=` keeps working); also settable per
+  * deployment via `env.LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN`
+  * (`1`/`true`/`on`/`yes`/`enabled`), which the shard/relay Durable Objects
+  * honor for their own upgrade gate too. Flipping it on is the step that
+  * actually closes the URL/log leak — do so once every studio the
+  * deployment uses mints ephemeral tokens.
+  */
+  requireEphemeralWsToken?: boolean;
+  /**
   * Resolve the calling identity from the inbound RPC request. Called once
   * per RPC (and per fan-out) before the request is forwarded to the
   * shard. The returned `userId` becomes `ctx.auth.userId` on the shard
@@ -2862,4 +2863,4 @@ declare const otlpSink: (options: OtlpSinkOptions) => ObservabilitySink;
 */
 declare const combineSinks: (...sinks: ObservabilitySink[]) => ObservabilitySink;
 declare const VERSION: string;
-export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthIntrospector, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };
+export { type AdminTableResolver, type AirbyteMessage, type AnalyticsEngineDataPointLike, type AnalyticsEngineDatasetLike, type AnalyticsEngineSinkOptions, type AuthAdmin, type AuthCapabilities, type AuthConfigInfo, type AuthImpersonation, type AuthPage, type AuthSession, type AuthUser, type AuthUserFieldSpec, type BackupManifest, type BackupStore, type ComposeIdentityResolversErrorMode, type ComposeIdentityResolversOptions, type ConnectorChange, type ConnectorSyncPage, type CorsOptions, type CronHandler, type CronJobDispatch, type CronJobInfo, type CrossShardCounter, type CrossShardReader, type CrossShardRelationCapabilities, type CrossShardRelationOptions, type CsrfOptions, DEFAULT_REGISTRY_CACHE_TTL_MS, type DurableObjectJurisdiction, type DynamicShardRegistry, type DynamicShardRegistryOptions, type ExecutionContextLike, type ExportFanOutRequest, type ExportFanOutResult, type FanOutRequest, type FanOutResult, type FanOutSpec, type FivetranResponse, type FrameworkHostHandler, type FrameworkWorkerOptions, type FrameworkWorkerOptionsInput, type FunctionDescriptor, type FunctionRegistryEntry, type FunctionRegistryLike, type GlobalExportFunction as GlobalExportFn, type GlobalImportFunction as GlobalImportFn, type GlobalIntrospector, type GlobalTableInfo as GlobalTableInfoMeta, type GlobalTablePage as GlobalTablePageMeta, type HttpActionContext, type HttpActionLike, type HttpRouterLike, type IdentityContractLike, type IdentityResolver, type IdentityValidation, type ImportFanOutRequest, type ImportFanOutResult, type KvIntrospector, type KvKeyEntry, type KvKeyListResult, type KvNamespaceSummary, type KvValueResult, type ListAuthUsersOptions, type LogEvent, type LogLevel, LunoraError, type LunoraErrorBody, type LunoraHandlerOptions, type LunoraWorker, type MergeStrategy, type MigrationFanOutRequest, type MigrationFanOutResult, NOOP_EXECUTION_CONTEXT, type ObservabilityEvent, type ObservabilitySink, type ObservabilitySinkContext, type OtlpSinkOptions, type QueryCoordinator, type QueryCoordinatorOptions, type RankFanOutRequest, type RankFanOutResult, type RankPageFanOutRequest, type RankPageFanOutResult, type ResolvedSecurity, type ResolvedShard, type Route, type RpcContext, type RpcEnvelope, SHARD_REGISTRY_DO_NAME, type ScheduledControllerLike, type SecurityHeadersOptions, type SecurityOptions, type SentrySinkOptions, type ShardError, type ShardExportOutcome, type ShardImportOutcome, type ShardMigrationOutcome, type ShardNamespaceLike, type ShardRankOutcome, type ShardRankPageOutcome, type ShardRegistry, type ShardTrafficEntry, type ShardTrafficFanOutRequest, type ShardTrafficFanOutResult, type ShardingInfo, type StorageListFunction as StorageListFn, type StorageObject, VERSION, type VectorIndexSummary, type VectorIntrospector, type VectorQueryMatch, type WebhookSinkOptions, type WorkerOptions, analyticsEngineSink, applyJurisdiction, combineSinks, composeIdentityResolvers, composeWorker, consoleSink, createCrossShardRelationCapabilities, createDynamicShardRegistry, createLunoraHandler, createQueryCoordinator, createStaticShardRegistry, createWorker, decorateResponse, defineRpcEnvelope, emitLogEvent, emitRpcEvent, enforceOrigin, handleCorsPreflight, mergeStrategyForAggregate, otlpSink, resolveLunoraOptions, resolveSecurity, resolveShard, routeIdentityResolvers, sentrySink, toAirbyteMessages, toErrorResponse, toFivetranResponse, webhookSink, withFrameworkWorker };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-UZKPkF3Q.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-B6Pzfwhg.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';

package/dist/packem_shared/{composeWorker-UZKPkF3Q.mjs → composeWorker-B6Pzfwhg.mjs}

@@ -21,6 +21,75 @@ const evictOldestEntry = (map, capacity) => {
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
 
+const textEncoder = new TextEncoder();
+const toBase64Url = (bytes) => {
+  const binary = String.fromCodePoint(...bytes);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const fromBase64Url = (input) => {
+  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.codePointAt(index) ?? 0;
+  }
+  return bytes;
+};
+const KEY_CACHE_MAX = 64;
+const keyCache = /* @__PURE__ */ new Map();
+const importHmacKey = async (secret) => {
+  const cached = keyCache.get(secret);
+  if (cached) {
+    return cached;
+  }
+  evictOldestEntry(keyCache, KEY_CACHE_MAX);
+  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
+  keyCache.set(secret, keyPromise);
+  return keyPromise;
+};
+const signCanonical = async (secret, canonical) => {
+  const cryptoKey = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
+  return toBase64Url(new Uint8Array(signature));
+};
+const verifyCanonical = async (secret, canonical, sigBytes) => {
+  const cryptoKey = await importHmacKey(secret);
+  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
+};
+
+const WS_ADMIN_TOKEN_VERSION = "v1";
+const WS_ADMIN_TOKEN_TTL_MS = 6e4;
+const mintWsAdminToken = async (secret, options = {}) => {
+  const expiresAtMs = (options.now ?? Date.now()) + (options.ttlMs ?? WS_ADMIN_TOKEN_TTL_MS);
+  const canonical = `${WS_ADMIN_TOKEN_VERSION}.${String(expiresAtMs)}`;
+  const signature = await signCanonical(secret, canonical);
+  return { expiresAtMs, token: `${canonical}.${signature}` };
+};
+const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
+  if (secret.length === 0 || token.length === 0) {
+    return false;
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [version, expString, signature] = parts;
+  if (version !== WS_ADMIN_TOKEN_VERSION || signature.length === 0) {
+    return false;
+  }
+  const expiresAtMs = Number(expString);
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now) {
+    return false;
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = fromBase64Url(signature);
+  } catch {
+    return false;
+  }
+  return verifyCanonical(secret, `${version}.${expString}`, signatureBytes);
+};
+
 const AUTH_BASE = "/_lunora/admin/auth";
 const AUTH_ADMIN_ERROR_STATUS = {
   INVITER_REQUIRED: 400,
@@ -1615,11 +1684,11 @@ const buildScheduledAdminRoutes = (deps) => {
     const stub = resolveSchedulerStub(request);
     return stub.fetch(new Request("https://scheduler.internal/status", { method: "GET" }));
   };
-  const handleScheduledWebSocket = (request) => {
+  const handleScheduledWebSocket = async (request) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
-    if (!checkWsAdmin(request)) {
+    if (!await checkWsAdmin(request)) {
       throw new LunoraError("admin authorization required", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     const namespace = requireSchedulerNamespace();
@@ -1920,10 +1989,12 @@ const WS_PATH = "/_lunora/ws";
 const VOICE_PATH_PREFIX = "/_lunora/voice/";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const ADMIN_WS_TOKEN_PATH = "/_lunora/admin/ws-token";
 const ADMIN_PATH_PREFIX = "/_lunora/admin/";
 const MIGRATE_PATH = "/_lunora/migrate";
 const STATUS_PATH = "/_lunora/status";
 const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
+const REQUIRE_EPHEMERAL_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
 const readForwardedIdentity = (request) => {
   const forwardedUserId = request.headers.get("x-lunora-userid");
   const forwardedIdentity = request.headers.get("x-lunora-identity");
@@ -2188,12 +2259,21 @@ const checkAdminAuth = (request, expected) => {
   }
   return constantTimeEqual(expected, rest.join(" ").trim());
 };
-const checkAdminWsToken = (request, expected) => {
+const checkAdminWsToken = async (request, expected, requireEphemeral) => {
   if (!expected || expected.length === 0) {
     return false;
   }
   const supplied = new URL(request.url).searchParams.get("token");
-  return supplied !== null && constantTimeEqual(expected, supplied);
+  if (supplied === null) {
+    return false;
+  }
+  if (await verifyWsAdminToken(expected, supplied)) {
+    return true;
+  }
+  if (requireEphemeral) {
+    return false;
+  }
+  return constantTimeEqual(expected, supplied);
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
@@ -2202,11 +2282,20 @@ const createWorker = (options) => {
   const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
   let envAdminToken;
   const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
+  let envRequireEphemeralWsToken;
+  const effectiveRequireEphemeralWsToken = () => options.requireEphemeralWsToken ?? envRequireEphemeralWsToken ?? false;
   const resolveAdminTokenFromEnv = (env) => {
+    const record = env ?? {};
+    if (envRequireEphemeralWsToken === void 0 && options.requireEphemeralWsToken === void 0) {
+      const raw = record["LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN"];
+      if (typeof raw === "string" && raw.length > 0) {
+        envRequireEphemeralWsToken = REQUIRE_EPHEMERAL_ENV_VALUES.has(raw.trim().toLowerCase());
+      }
+    }
     if (envAdminToken !== void 0 || options.adminToken !== void 0) {
       return;
     }
-    const value = (env ?? {})["LUNORA_ADMIN_TOKEN"];
+    const value = record["LUNORA_ADMIN_TOKEN"];
     if (typeof value === "string" && value.length > 0) {
       envAdminToken = value;
     }
@@ -2447,7 +2536,7 @@ const createWorker = (options) => {
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken()),
+    checkWsAdmin: async (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken(), effectiveRequireEphemeralWsToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -2988,33 +3077,22 @@ const createWorker = (options) => {
     const tables = options.backupTables;
     let rows = 0;
     let bytes = 0;
-    let streamError;
-    const stream = new ReadableStream({
-      async pull(streamController) {
-        const writeRow = (row) => {
-          const encoded = NDJSON_ENCODER.encode(`${JSON.stringify(row)}
-`);
-          rows += 1;
-          bytes += encoded.byteLength;
-          streamController.enqueue(encoded);
-        };
-        try {
-          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
-          streamController.close();
-        } catch (error) {
-          streamError = error instanceof Error ? error : new Error(String(error));
-          streamController.error(error);
-        }
-      }
-    });
+    const parts = [];
+    const writeRow = (row) => {
+      const line = `${JSON.stringify(row)}
+`;
+      rows += 1;
+      bytes += NDJSON_ENCODER.encode(line).byteLength;
+      parts.push(line);
+    };
+    await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
     const prefix = options.backupPrefix ?? "backups/";
     const timestamp = new Date(controller.scheduledTime).toISOString();
     const fileKey = `${prefix}lunora-backup-${timestamp.replaceAll(/[.:]/gu, "-")}.ndjson`;
     const manifestKey = `${fileKey}.manifest.json`;
-    await store.put(fileKey, stream, { httpMetadata: { contentType: "application/x-ndjson" } });
-    if (streamError !== void 0) {
-      throw streamError;
-    }
+    await store.put(fileKey, new Blob(parts, { type: "application/x-ndjson" }), {
+      httpMetadata: { contentType: "application/x-ndjson" }
+    });
     const manifest = {
       bytes,
       createdAt: timestamp,
@@ -3100,6 +3178,24 @@ const createWorker = (options) => {
     [RPC_BATCH_PATH]: (request, env, _url, context) => handleBatchRpc(request, env, context),
     [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
     [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
+    // Mint a short-lived HMAC-signed WS admin sub-token. Gated by the master
+    // admin bearer (header) / `adminGate`; the studio then sends the minted
+    // token — not the master credential — in the WS `?token=`
+    // query string. Signed with the master token itself, so both isolates
+    // verify statelessly and rotating `LUNORA_ADMIN_TOKEN` invalidates every
+    // outstanding sub-token. `no-store` keeps the token out of caches.
+    [ADMIN_WS_TOKEN_PATH]: async (request) => {
+      if (request.method !== "POST") {
+        throw new LunoraError("ws-token endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+      }
+      assertAdminAuthorized(request);
+      const signingSecret = effectiveAdminToken();
+      if (signingSecret === void 0) {
+        throw new LunoraError("ws-token minting requires a configured admin token", { code: "ADMIN_TOKEN_NOT_CONFIGURED", status: 400 });
+      }
+      const minted = await mintWsAdminToken(signingSecret);
+      return Response.json(minted, { headers: { "cache-control": "no-store" } });
+    },
     // Extracted handler clusters built above, merged in (mirroring the auth
     // plane below): orchestration (migrate / rank / rankpage / shard-traffic /
     // pitr), data-movement (export / import / sync / connector-sync / apply),
@@ -3117,8 +3213,7 @@ const createWorker = (options) => {
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
     ...buildAuthAdminRoutes({
       assertAdmin: assertAdminAuthorized,
-      // eslint-disable-next-line sonarjs/deprecation -- `authIntrospector` is the intentional read-only fallback
-      getAuthAdmin: () => options.authAdmin ?? options.authIntrospector,
+      getAuthAdmin: () => options.authAdmin,
       parsePaging,
       queryParameter,
       readJsonBody: readJsonBodyWithLimit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.27",
+  "version": "1.0.0-alpha.28",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.4"
+    "@lunora/errors": "1.0.0-alpha.5"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"