@lunora/runtime 1.0.0-alpha.27 → 1.0.0-alpha.29

package/dist/index.mjs

@@ -1,10 +1,10 @@
 export { toAirbyteMessages, toFivetranResponse } from './packem_shared/toAirbyteMessages-DrHdplb4.mjs';
-export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-UZKPkF3Q.mjs';
+export { composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, resolveLunoraOptions, withFrameworkWorker } from './packem_shared/composeWorker-Br4_GgSW.mjs';
 export { createCrossShardRelationCapabilities } from './packem_shared/createCrossShardRelationCapabilities-CbcWjkAn.mjs';
 export { DEFAULT_REGISTRY_CACHE_TTL_MS, SHARD_REGISTRY_DO_NAME, createDynamicShardRegistry } from './packem_shared/DEFAULT_REGISTRY_CACHE_TTL_MS-B3pA7aXp.mjs';
 export { LunoraError, toErrorResponse } from './packem_shared/LunoraError-Bpb9EFJ3.mjs';
 export { emitLogEvent, emitRpcEvent } from './packem_shared/emitLogEvent-pEdtqAK8.mjs';
-export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-F-5ZAdUA.mjs';
+export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, pipelineLogSink, sentrySink, webhookSink } from './packem_shared/analyticsEngineSink-DKZvbDFG.mjs';
 export { createQueryCoordinator, createStaticShardRegistry, mergeStrategyForAggregate } from './packem_shared/createQueryCoordinator-DNCJzOZE.mjs';
 export { applyJurisdiction, resolveShard } from './packem_shared/applyJurisdiction-BkZtTkct.mjs';
 export { decorateResponse, enforceOrigin, handleCorsPreflight, resolveSecurity } from './packem_shared/decorateResponse-DRWQFNhF.mjs';

package/dist/packem_shared/{analyticsEngineSink-F-5ZAdUA.mjs → analyticsEngineSink-DKZvbDFG.mjs}

@@ -1,4 +1,16 @@
-import { m as mergeHeaders, o as otlpRandomHex, w as wrapResourceSpans, a as wrapResourceLogs, e as encodeAttribute, O as OTLP_SEVERITY, c as otlpUnixNano } from './otlp-D_YzGXu1.mjs';
+import { m as mergeHeaders, o as otlpRandomHex, w as wrapResourceSpans, e as encodeAttribute, a as wrapResourceLogs, O as OTLP_SEVERITY, c as otlpUnixNano } from './otlp-0FQT3AI8.mjs';
+
+const stringifyFieldValue = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  try {
+    return JSON.stringify(value) ?? String(value);
+  } catch {
+    return String(value);
+  }
+};
+const coerceFieldValue = (value) => typeof value === "boolean" || typeof value === "number" || typeof value === "string" ? value : stringifyFieldValue(value);
 
 const shouldSkip = (event, onlyErrors) => onlyErrors === true && event.ok;
 const otlpTraceBody = (event, serviceName, endMs) => {
@@ -33,20 +45,32 @@ const otlpTraceBody = (event, serviceName, endMs) => {
   return wrapResourceSpans(span, "@lunora/runtime", serviceName);
 };
 const otlpLogBody = (event, serviceName) => {
-  const attributes = [encodeAttribute("lunora.function_path", event.functionPath)];
+  const attributeByKey = /* @__PURE__ */ new Map();
+  attributeByKey.set("lunora.function_path", encodeAttribute("lunora.function_path", event.functionPath));
   if (event.shardKey !== void 0) {
-    attributes.push(encodeAttribute("lunora.shard_key", event.shardKey));
+    attributeByKey.set("lunora.shard_key", encodeAttribute("lunora.shard_key", event.shardKey));
   }
   if (event.userId !== void 0) {
-    attributes.push(encodeAttribute("lunora.user_id", event.userId));
+    attributeByKey.set("lunora.user_id", encodeAttribute("lunora.user_id", event.userId));
+  }
+  if (event.fields) {
+    for (const [key, value] of Object.entries(event.fields)) {
+      attributeByKey.set(key, encodeAttribute(key, coerceFieldValue(value)));
+    }
   }
   const logRecord = {
-    attributes,
+    attributes: [...attributeByKey.values()],
     body: { stringValue: event.message },
     severityNumber: OTLP_SEVERITY[event.level],
     severityText: event.level.toUpperCase(),
     timeUnixNano: otlpUnixNano(event.ts)
   };
+  if (event.traceId !== void 0) {
+    logRecord.traceId = event.traceId;
+  }
+  if (event.spanId !== void 0) {
+    logRecord.spanId = event.spanId;
+  }
   return wrapResourceLogs(logRecord, "@lunora/runtime", serviceName);
 };
 const otlpPost = (url, body, headers, context) => {
@@ -63,7 +87,7 @@ const consoleSink = (options = {}) => {
   const { onlyErrors } = options;
   return {
     onLog: (event) => {
-      if (event.level === "error") {
+      if (event.level === "error" || event.level === "fatal") {
         console.error("[lunora:log]", event.functionPath, event.message);
       } else {
         console.log("[lunora:log]", event.functionPath, event.message);
@@ -82,9 +106,33 @@ const consoleSink = (options = {}) => {
   };
 };
 const webhookSink = (options) => {
-  const { headers, onlyErrors, transform, url } = options;
+  const { headers, onlyErrors, transform, transformLog, url } = options;
   const mergedHeaders = mergeHeaders({ "content-type": "application/json" }, headers);
+  const post = (payload, context) => {
+    try {
+      const sent = fetch(url, { body: JSON.stringify(payload), headers: mergedHeaders, method: "POST" }).catch(() => {
+      });
+      if (context?.waitUntil) {
+        context.waitUntil(sent);
+      }
+    } catch {
+    }
+  };
   return {
+    onLog: (event, context) => {
+      let payload = event;
+      if (transformLog) {
+        try {
+          payload = transformLog(event);
+        } catch {
+          return;
+        }
+      }
+      if (payload === null || payload === void 0) {
+        return;
+      }
+      post(payload, context);
+    },
     onRpc: (event, context) => {
       if (shouldSkip(event, onlyErrors)) {
         return;
@@ -101,24 +149,24 @@ const webhookSink = (options) => {
         if (payload === null || payload === void 0) {
           return;
         }
-        const sent = fetch(url, {
-          body: JSON.stringify(payload),
-          headers: mergedHeaders,
-          method: "POST"
-        }).catch(() => {
-        });
-        if (context?.waitUntil) {
-          context.waitUntil(sent);
-        }
+        post(payload, context);
       } catch {
       }
     }
   };
 };
 const sentrySink = (options) => {
-  const { capture } = options;
+  const { capture, captureLog } = options;
   const onlyErrors = options.onlyErrors ?? true;
   return {
+    // Only forward log lines when the caller wired `captureLog`; otherwise
+    // `ctx.log` output stays out of Sentry.
+    onLog: captureLog ? (event) => {
+      try {
+        captureLog(event);
+      } catch {
+      }
+    } : void 0,
     onRpc: (event) => {
       if (shouldSkip(event, onlyErrors)) {
         return;
@@ -148,6 +196,42 @@ const analyticsEngineSink = (options) => {
     }
   };
 };
+const pipelineLogSink = (options) => {
+  const { pipeline } = options;
+  return {
+    onLog: (event, context) => {
+      try {
+        const record = {
+          functionPath: event.functionPath,
+          level: event.level,
+          message: event.message,
+          ts: event.ts
+        };
+        if (event.fields) {
+          record.fields = event.fields;
+        }
+        if (event.shardKey !== void 0) {
+          record.shardKey = event.shardKey;
+        }
+        if (event.userId !== void 0) {
+          record.userId = event.userId;
+        }
+        if (event.traceId !== void 0) {
+          record.traceId = event.traceId;
+        }
+        if (event.spanId !== void 0) {
+          record.spanId = event.spanId;
+        }
+        const sent = pipeline.send([record]).catch(() => {
+        });
+        if (context?.waitUntil) {
+          context.waitUntil(sent);
+        }
+      } catch {
+      }
+    }
+  };
+};
 const otlpSink = (options) => {
   const { endpoint, headers, onlyErrors, token } = options;
   const serviceName = options.serviceName ?? "lunora";
@@ -197,4 +281,4 @@ const combineSinks = (...sinks) => {
   };
 };
 
-export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, sentrySink, webhookSink };
+export { analyticsEngineSink, combineSinks, consoleSink, otlpSink, pipelineLogSink, sentrySink, webhookSink };

package/dist/packem_shared/{composeWorker-UZKPkF3Q.mjs → composeWorker-Br4_GgSW.mjs}

@@ -1,6 +1,6 @@
 import { isLunoraError, toErrorBody } from '@lunora/errors';
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-import { o as otlpRandomHex, b as buildTraceparent } from './otlp-D_YzGXu1.mjs';
+import { o as otlpRandomHex, b as buildTraceparent } from './otlp-0FQT3AI8.mjs';
 import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
 import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
@@ -21,6 +21,75 @@ const evictOldestEntry = (map, capacity) => {
 const RELAY_NAME_INFIX = "::relay::";
 const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
 
+const textEncoder = new TextEncoder();
+const toBase64Url = (bytes) => {
+  const binary = String.fromCodePoint(...bytes);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const fromBase64Url = (input) => {
+  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.codePointAt(index) ?? 0;
+  }
+  return bytes;
+};
+const KEY_CACHE_MAX = 64;
+const keyCache = /* @__PURE__ */ new Map();
+const importHmacKey = async (secret) => {
+  const cached = keyCache.get(secret);
+  if (cached) {
+    return cached;
+  }
+  evictOldestEntry(keyCache, KEY_CACHE_MAX);
+  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
+  keyCache.set(secret, keyPromise);
+  return keyPromise;
+};
+const signCanonical = async (secret, canonical) => {
+  const cryptoKey = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
+  return toBase64Url(new Uint8Array(signature));
+};
+const verifyCanonical = async (secret, canonical, sigBytes) => {
+  const cryptoKey = await importHmacKey(secret);
+  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
+};
+
+const WS_ADMIN_TOKEN_VERSION = "v1";
+const WS_ADMIN_TOKEN_TTL_MS = 6e4;
+const mintWsAdminToken = async (secret, options = {}) => {
+  const expiresAtMs = (options.now ?? Date.now()) + (options.ttlMs ?? WS_ADMIN_TOKEN_TTL_MS);
+  const canonical = `${WS_ADMIN_TOKEN_VERSION}.${String(expiresAtMs)}`;
+  const signature = await signCanonical(secret, canonical);
+  return { expiresAtMs, token: `${canonical}.${signature}` };
+};
+const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
+  if (secret.length === 0 || token.length === 0) {
+    return false;
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [version, expString, signature] = parts;
+  if (version !== WS_ADMIN_TOKEN_VERSION || signature.length === 0) {
+    return false;
+  }
+  const expiresAtMs = Number(expString);
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now) {
+    return false;
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = fromBase64Url(signature);
+  } catch {
+    return false;
+  }
+  return verifyCanonical(secret, `${version}.${expString}`, signatureBytes);
+};
+
 const AUTH_BASE = "/_lunora/admin/auth";
 const AUTH_ADMIN_ERROR_STATUS = {
   INVITER_REQUIRED: 400,
@@ -1615,11 +1684,11 @@ const buildScheduledAdminRoutes = (deps) => {
     const stub = resolveSchedulerStub(request);
     return stub.fetch(new Request("https://scheduler.internal/status", { method: "GET" }));
   };
-  const handleScheduledWebSocket = (request) => {
+  const handleScheduledWebSocket = async (request) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
-    if (!checkWsAdmin(request)) {
+    if (!await checkWsAdmin(request)) {
       throw new LunoraError("admin authorization required", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     const namespace = requireSchedulerNamespace();
@@ -1920,10 +1989,12 @@ const WS_PATH = "/_lunora/ws";
 const VOICE_PATH_PREFIX = "/_lunora/voice/";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const ADMIN_WS_TOKEN_PATH = "/_lunora/admin/ws-token";
 const ADMIN_PATH_PREFIX = "/_lunora/admin/";
 const MIGRATE_PATH = "/_lunora/migrate";
 const STATUS_PATH = "/_lunora/status";
 const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
+const REQUIRE_EPHEMERAL_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
 const readForwardedIdentity = (request) => {
   const forwardedUserId = request.headers.get("x-lunora-userid");
   const forwardedIdentity = request.headers.get("x-lunora-identity");
@@ -2188,12 +2259,21 @@ const checkAdminAuth = (request, expected) => {
   }
   return constantTimeEqual(expected, rest.join(" ").trim());
 };
-const checkAdminWsToken = (request, expected) => {
+const checkAdminWsToken = async (request, expected, requireEphemeral) => {
   if (!expected || expected.length === 0) {
     return false;
   }
   const supplied = new URL(request.url).searchParams.get("token");
-  return supplied !== null && constantTimeEqual(expected, supplied);
+  if (supplied === null) {
+    return false;
+  }
+  if (await verifyWsAdminToken(expected, supplied)) {
+    return true;
+  }
+  if (requireEphemeral) {
+    return false;
+  }
+  return constantTimeEqual(expected, supplied);
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
@@ -2202,11 +2282,20 @@ const createWorker = (options) => {
   const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
   let envAdminToken;
   const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
+  let envRequireEphemeralWsToken;
+  const effectiveRequireEphemeralWsToken = () => options.requireEphemeralWsToken ?? envRequireEphemeralWsToken ?? false;
   const resolveAdminTokenFromEnv = (env) => {
+    const record = env ?? {};
+    if (envRequireEphemeralWsToken === void 0 && options.requireEphemeralWsToken === void 0) {
+      const raw = record["LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN"];
+      if (typeof raw === "string" && raw.length > 0) {
+        envRequireEphemeralWsToken = REQUIRE_EPHEMERAL_ENV_VALUES.has(raw.trim().toLowerCase());
+      }
+    }
     if (envAdminToken !== void 0 || options.adminToken !== void 0) {
       return;
     }
-    const value = (env ?? {})["LUNORA_ADMIN_TOKEN"];
+    const value = record["LUNORA_ADMIN_TOKEN"];
     if (typeof value === "string" && value.length > 0) {
       envAdminToken = value;
     }
@@ -2447,7 +2536,7 @@ const createWorker = (options) => {
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken()),
+    checkWsAdmin: async (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken(), effectiveRequireEphemeralWsToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -2988,33 +3077,22 @@ const createWorker = (options) => {
     const tables = options.backupTables;
     let rows = 0;
     let bytes = 0;
-    let streamError;
-    const stream = new ReadableStream({
-      async pull(streamController) {
-        const writeRow = (row) => {
-          const encoded = NDJSON_ENCODER.encode(`${JSON.stringify(row)}
-`);
-          rows += 1;
-          bytes += encoded.byteLength;
-          streamController.enqueue(encoded);
-        };
-        try {
-          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
-          streamController.close();
-        } catch (error) {
-          streamError = error instanceof Error ? error : new Error(String(error));
-          streamController.error(error);
-        }
-      }
-    });
+    const parts = [];
+    const writeRow = (row) => {
+      const line = `${JSON.stringify(row)}
+`;
+      rows += 1;
+      bytes += NDJSON_ENCODER.encode(line).byteLength;
+      parts.push(line);
+    };
+    await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
     const prefix = options.backupPrefix ?? "backups/";
     const timestamp = new Date(controller.scheduledTime).toISOString();
     const fileKey = `${prefix}lunora-backup-${timestamp.replaceAll(/[.:]/gu, "-")}.ndjson`;
     const manifestKey = `${fileKey}.manifest.json`;
-    await store.put(fileKey, stream, { httpMetadata: { contentType: "application/x-ndjson" } });
-    if (streamError !== void 0) {
-      throw streamError;
-    }
+    await store.put(fileKey, new Blob(parts, { type: "application/x-ndjson" }), {
+      httpMetadata: { contentType: "application/x-ndjson" }
+    });
     const manifest = {
       bytes,
       createdAt: timestamp,
@@ -3100,6 +3178,24 @@ const createWorker = (options) => {
     [RPC_BATCH_PATH]: (request, env, _url, context) => handleBatchRpc(request, env, context),
     [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
     [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
+    // Mint a short-lived HMAC-signed WS admin sub-token. Gated by the master
+    // admin bearer (header) / `adminGate`; the studio then sends the minted
+    // token — not the master credential — in the WS `?token=`
+    // query string. Signed with the master token itself, so both isolates
+    // verify statelessly and rotating `LUNORA_ADMIN_TOKEN` invalidates every
+    // outstanding sub-token. `no-store` keeps the token out of caches.
+    [ADMIN_WS_TOKEN_PATH]: async (request) => {
+      if (request.method !== "POST") {
+        throw new LunoraError("ws-token endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+      }
+      assertAdminAuthorized(request);
+      const signingSecret = effectiveAdminToken();
+      if (signingSecret === void 0) {
+        throw new LunoraError("ws-token minting requires a configured admin token", { code: "ADMIN_TOKEN_NOT_CONFIGURED", status: 400 });
+      }
+      const minted = await mintWsAdminToken(signingSecret);
+      return Response.json(minted, { headers: { "cache-control": "no-store" } });
+    },
     // Extracted handler clusters built above, merged in (mirroring the auth
     // plane below): orchestration (migrate / rank / rankpage / shard-traffic /
     // pitr), data-movement (export / import / sync / connector-sync / apply),
@@ -3117,8 +3213,7 @@ const createWorker = (options) => {
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
     ...buildAuthAdminRoutes({
       assertAdmin: assertAdminAuthorized,
-      // eslint-disable-next-line sonarjs/deprecation -- `authIntrospector` is the intentional read-only fallback
-      getAuthAdmin: () => options.authAdmin ?? options.authIntrospector,
+      getAuthAdmin: () => options.authAdmin,
       parsePaging,
       queryParameter,
       readJsonBody: readJsonBodyWithLimit

package/dist/packem_shared/{otlp-D_YzGXu1.mjs → otlp-0FQT3AI8.mjs}

@@ -3,10 +3,14 @@ const OTLP_SEVERITY = {
   // DEBUG
   error: 17,
   // ERROR
+  fatal: 21,
+  // FATAL
   info: 9,
   // INFO
   log: 9,
   // INFO
+  trace: 1,
+  // TRACE
   warn: 13
   // WARN
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/runtime",
-  "version": "1.0.0-alpha.27",
+  "version": "1.0.0-alpha.29",
   "description": "Lunora Worker runtime: the RPC router, shard resolver, and query coordinator",
   "keywords": [
     "cloudflare",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.4"
+    "@lunora/errors": "1.0.0-alpha.6"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"