@lunora/runtime 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/packem_shared/{composeWorker-CjF1xUIO.mjs → composeWorker-CqUlK17X.mjs}

@@ -1,10 +1,100 @@
-import { LunoraError, toErrorResponse, isStructuralLunoraError, isStructuralConflictError } from './LunoraError-CL0aOtpo.mjs';
+import { isLunoraError, toErrorBody } from '@lunora/errors';
+import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
+import { o as otlpRandomHex, b as buildTraceparent } from './otlp-DOLuy1Aj.mjs';
+import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
+import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
+export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
 import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
-import { resolveShard } from './resolveShard-DDkzWtrU.mjs';
-import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse } from './decorateResponse-DbISh_Wi.mjs';
+import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
+import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-DRWQFNhF.mjs';
+
+const evictOldestEntry = (map, capacity) => {
+  if (map.size < capacity) {
+    return;
+  }
+  const oldest = map.keys().next().value;
+  if (oldest !== void 0) {
+    map.delete(oldest);
+  }
+};
+
+const RELAY_NAME_INFIX = "::relay::";
+const relayName = (ownerKey, index) => `${ownerKey}${RELAY_NAME_INFIX}${String(index)}`;
+
+const textEncoder = new TextEncoder();
+const toBase64Url = (bytes) => {
+  const binary = String.fromCodePoint(...bytes);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const fromBase64Url = (input) => {
+  const padded = input.replaceAll("-", "+").replaceAll("_", "/") + "===".slice((input.length + 3) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.codePointAt(index) ?? 0;
+  }
+  return bytes;
+};
+const KEY_CACHE_MAX = 64;
+const keyCache = /* @__PURE__ */ new Map();
+const importHmacKey = async (secret) => {
+  const cached = keyCache.get(secret);
+  if (cached) {
+    return cached;
+  }
+  evictOldestEntry(keyCache, KEY_CACHE_MAX);
+  const keyPromise = crypto.subtle.importKey("raw", textEncoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
+  keyCache.set(secret, keyPromise);
+  return keyPromise;
+};
+const signCanonical = async (secret, canonical) => {
+  const cryptoKey = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, textEncoder.encode(canonical));
+  return toBase64Url(new Uint8Array(signature));
+};
+const verifyCanonical = async (secret, canonical, sigBytes) => {
+  const cryptoKey = await importHmacKey(secret);
+  return crypto.subtle.verify("HMAC", cryptoKey, sigBytes, textEncoder.encode(canonical));
+};
+
+const WS_ADMIN_TOKEN_VERSION = "v1";
+const WS_ADMIN_TOKEN_TTL_MS = 6e4;
+const mintWsAdminToken = async (secret, options = {}) => {
+  const expiresAtMs = (options.now ?? Date.now()) + (options.ttlMs ?? WS_ADMIN_TOKEN_TTL_MS);
+  const canonical = `${WS_ADMIN_TOKEN_VERSION}.${String(expiresAtMs)}`;
+  const signature = await signCanonical(secret, canonical);
+  return { expiresAtMs, token: `${canonical}.${signature}` };
+};
+const verifyWsAdminToken = async (secret, token, now = Date.now()) => {
+  if (secret.length === 0 || token.length === 0) {
+    return false;
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return false;
+  }
+  const [version, expString, signature] = parts;
+  if (version !== WS_ADMIN_TOKEN_VERSION || signature.length === 0) {
+    return false;
+  }
+  const expiresAtMs = Number(expString);
+  if (!Number.isFinite(expiresAtMs) || expiresAtMs <= now) {
+    return false;
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = fromBase64Url(signature);
+  } catch {
+    return false;
+  }
+  return verifyCanonical(secret, `${version}.${expString}`, signatureBytes);
+};
 
 const AUTH_BASE = "/_lunora/admin/auth";
 const AUTH_ADMIN_ERROR_STATUS = {
+  INVITER_REQUIRED: 400,
+  ORG_SLUG_INVALID: 400,
+  ORG_SLUG_TAKEN: 409,
   PASSWORD_TOO_LONG: 400,
   PASSWORD_TOO_SHORT: 400,
   USER_ALREADY_EXISTS: 409,
@@ -34,6 +124,23 @@ const parseRoleInput = (value) => {
   return void 0;
 };
 const optionalBodyString = (body, field) => typeof body[field] === "string" ? body[field] : void 0;
+const optionalBodyObject = (body, field) => {
+  const value = body[field];
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+};
+const requirePermission = (body) => {
+  const value = body["permission"];
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new LunoraError("`permission` object is required", { code: "BAD_REQUEST", status: 400 });
+  }
+  const out = {};
+  for (const [resource, actions] of Object.entries(value)) {
+    if (Array.isArray(actions) && actions.every((action) => typeof action === "string")) {
+      out[resource] = actions;
+    }
+  }
+  return out;
+};
 const AUTH_ROUTES = {
   [`${AUTH_BASE}/capabilities`]: {
     build: () => {
@@ -100,6 +207,34 @@ const AUTH_ROUTES = {
     http: "GET",
     method: "listInvitations"
   },
+  [`${AUTH_BASE}/config`]: {
+    build: () => {
+      return {};
+    },
+    http: "GET",
+    method: "config"
+  },
+  [`${AUTH_BASE}/organizations/teams`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listTeams"
+  },
+  [`${AUTH_BASE}/organizations/teams/members`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, teamId: requireQuery$1(query, "teamId") };
+    },
+    http: "GET",
+    method: "listTeamMembers"
+  },
+  [`${AUTH_BASE}/organizations/roles`]: {
+    build: ({ paging, query }) => {
+      return { ...paging, organizationId: requireQuery$1(query, "organizationId") };
+    },
+    http: "GET",
+    method: "listOrgRoles"
+  },
   // --- mutations (POST) -------------------------------------------------------
   [`${AUTH_BASE}/users/create`]: {
     build: ({ body }) => {
@@ -232,6 +367,137 @@ const AUTH_ROUTES = {
     http: "POST",
     method: "cancelInvitation",
     returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/create`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: requireBodyString(body, "name"),
+        ownerId: optionalBodyString(body, "ownerId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "createOrganization"
+  },
+  [`${AUTH_BASE}/organizations/update`]: {
+    build: ({ body }) => {
+      return {
+        logo: optionalBodyString(body, "logo"),
+        metadata: optionalBodyObject(body, "metadata"),
+        name: optionalBodyString(body, "name"),
+        organizationId: requireBodyString(body, "organizationId"),
+        slug: optionalBodyString(body, "slug")
+      };
+    },
+    http: "POST",
+    method: "updateOrganization"
+  },
+  [`${AUTH_BASE}/organizations/remove`]: {
+    build: ({ body }) => {
+      return { organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "deleteOrganization",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/members/add`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role"),
+        userId: requireBodyString(body, "userId")
+      };
+    },
+    http: "POST",
+    method: "addMember"
+  },
+  [`${AUTH_BASE}/organizations/members/invite`]: {
+    build: ({ body }) => {
+      return {
+        email: requireBodyString(body, "email"),
+        inviterId: optionalBodyString(body, "inviterId"),
+        organizationId: requireBodyString(body, "organizationId"),
+        role: optionalBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "inviteMember"
+  },
+  [`${AUTH_BASE}/organizations/members/role`]: {
+    build: ({ body }) => {
+      const role = parseRoleInput(body["role"]);
+      if (role === void 0 || typeof role === "string" && role.trim() === "") {
+        throw new LunoraError("`role` is required", { code: "BAD_REQUEST", status: 400 });
+      }
+      return { memberId: requireBodyString(body, "memberId"), role };
+    },
+    http: "POST",
+    method: "updateMemberRole"
+  },
+  [`${AUTH_BASE}/organizations/teams/create`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), organizationId: requireBodyString(body, "organizationId") };
+    },
+    http: "POST",
+    method: "createTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/update`]: {
+    build: ({ body }) => {
+      return { name: requireBodyString(body, "name"), teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "updateTeam"
+  },
+  [`${AUTH_BASE}/organizations/teams/remove`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId") };
+    },
+    http: "POST",
+    method: "removeTeam",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/add`]: {
+    build: ({ body }) => {
+      return { teamId: requireBodyString(body, "teamId"), userId: requireBodyString(body, "userId") };
+    },
+    http: "POST",
+    method: "addTeamMember"
+  },
+  [`${AUTH_BASE}/organizations/teams/members/remove`]: {
+    build: ({ body }) => {
+      return { teamMemberId: requireBodyString(body, "teamMemberId") };
+    },
+    http: "POST",
+    method: "removeTeamMember",
+    returns: "void"
+  },
+  [`${AUTH_BASE}/organizations/roles/create`]: {
+    build: ({ body }) => {
+      return {
+        organizationId: requireBodyString(body, "organizationId"),
+        permission: requirePermission(body),
+        role: requireBodyString(body, "role")
+      };
+    },
+    http: "POST",
+    method: "createOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/update`]: {
+    build: ({ body }) => {
+      return { permission: requirePermission(body), roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "updateOrgRole"
+  },
+  [`${AUTH_BASE}/organizations/roles/remove`]: {
+    build: ({ body }) => {
+      return { roleId: requireBodyString(body, "roleId") };
+    },
+    http: "POST",
+    method: "deleteOrgRole",
+    returns: "void"
   }
 };
 const buildAuthAdminRoutes = (deps) => {
@@ -244,15 +510,15 @@ const buildAuthAdminRoutes = (deps) => {
       }
       const candidate = error;
       const code = typeof candidate.code === "string" ? candidate.code : "AUTH_ADMIN_ERROR";
-      const message = typeof candidate.message === "string" ? candidate.message : "auth admin operation failed";
-      throw new LunoraError(message, { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 400 });
+      console.error("[lunora] auth admin operation failed:", error);
+      throw new LunoraError("auth admin operation failed", { code, status: AUTH_ADMIN_ERROR_STATUS[code] ?? 500 });
     }
   };
   const handle = async (request, descriptor) => {
+    deps.assertAdmin(request);
     if (request.method !== descriptor.http) {
       throw new LunoraError(`Auth admin endpoint requires ${descriptor.http}`, { code: "METHOD_NOT_ALLOWED", status: 405 });
     }
-    deps.assertAdmin(request);
     const admin = deps.getAuthAdmin();
     if (admin === void 0) {
       throw new LunoraError("auth endpoints require an `authAdmin` on the worker", { code: "AUTH_NOT_CONFIGURED", status: 400 });
@@ -278,6 +544,48 @@ const buildAuthAdminRoutes = (deps) => {
   return routes;
 };
 
+const MAX_BATCH_ENTRIES = 500;
+
+const normalizeBatchCall = (raw, index, defaultShard) => {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new LunoraError("each batch call must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  const call = raw;
+  if (typeof call.functionPath !== "string") {
+    throw new LunoraError("each batch call needs a string `functionPath`", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (call.functionPath.startsWith("__lunora_relation__:") || call.functionPath.startsWith("__lunora_admin__")) {
+    throw new LunoraError("reserved function path cannot be batched", { code: "FORBIDDEN", status: 403 });
+  }
+  if (call.args !== void 0 && (typeof call.args !== "object" || call.args === null || Array.isArray(call.args))) {
+    throw new LunoraError("each batch call `args` must be an object", { code: "BAD_REQUEST", status: 400 });
+  }
+  return {
+    entry: {
+      args: call.args === void 0 ? {} : call.args,
+      clientId: typeof call.clientId === "string" ? call.clientId : void 0,
+      clientSeq: typeof call.clientSeq === "number" ? call.clientSeq : void 0,
+      functionPath: call.functionPath,
+      id: typeof call.id === "number" ? call.id : index,
+      mutationId: typeof call.mutationId === "string" ? call.mutationId : void 0
+    },
+    shardKey: typeof call.shardKey === "string" ? call.shardKey : defaultShard
+  };
+};
+const groupBatchCallsByShard = (calls, defaultShard) => {
+  if (calls.length > MAX_BATCH_ENTRIES) {
+    throw new LunoraError(`RPC batch exceeds the ${String(MAX_BATCH_ENTRIES)}-call limit`, { code: "BAD_REQUEST", status: 400 });
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const [index, raw] of calls.entries()) {
+    const { entry, shardKey } = normalizeBatchCall(raw, index, defaultShard);
+    const group = groups.get(shardKey) ?? [];
+    group.push(entry);
+    groups.set(shardKey, group);
+  }
+  return groups;
+};
+
 const MAX_BODY_BYTES = 1048576;
 const readBodyTextWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   if (!request.body) {
@@ -335,9 +643,9 @@ const readBodyBytesWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   }
   return out.buffer;
 };
-const readJsonBodyWithLimit = async (request) => {
+const readJsonBodyWithLimit = async (request, limit = MAX_BODY_BYTES) => {
   try {
-    const text = await readBodyTextWithLimit(request);
+    const text = await readBodyTextWithLimit(request, limit);
     return text === "" ? {} : JSON.parse(text);
   } catch (error) {
     if (error instanceof LunoraError) {
@@ -597,14 +905,14 @@ const partitionExportTables = (options, tables) => {
   }
   return { globalTables, shardLocalTables };
 };
-const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow) => {
+const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace) => {
   if (tables !== void 0 && shardLocalTables.length === 0) {
     return;
   }
   const exportTables = tables === void 0 ? [] : shardLocalTables;
   const probeFallback = tables === void 0 ? collectKnownTables() : [];
   const probeTables = exportTables.length > 0 ? exportTables : probeFallback;
-  const result = await coordinator.orchestrateExport(options.shardDO, {
+  const result = await coordinator.orchestrateExport(namespace, {
     args: { tables: exportTables },
     headers: forwardedHeaders,
     tables: probeTables
@@ -618,9 +926,9 @@ const exportShardLocalRows = async (options, coordinator, forwardedHeaders, tabl
     }
   }
 };
-const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow) => {
+const streamExportRows = async (options, coordinator, forwardedHeaders, tables, writeRow, namespace) => {
   const { globalTables, shardLocalTables } = partitionExportTables(options, tables);
-  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow);
+  await exportShardLocalRows(options, coordinator, forwardedHeaders, tables, shardLocalTables, writeRow, namespace);
   const exportGlobalsFunction = options.exportGlobals;
   const wantGlobals = tables === void 0 || globalTables.length > 0;
   if (wantGlobals && exportGlobalsFunction) {
@@ -740,7 +1048,7 @@ const mergeImportResult = (totals, result) => {
   }
   totals.conflicts += result.conflicts;
 };
-const streamingImport = async (request, options, forwardedHeaders) => {
+const streamingImport = async (request, options, forwardedHeaders, namespace) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
   const { errors, globalRows, perShard } = await bucketImportStream(request, options, defaultShard);
   const totals = { conflicts: 0, errors, inserted: {} };
@@ -749,7 +1057,7 @@ const streamingImport = async (request, options, forwardedHeaders) => {
     if (!coordinator) {
       throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
     }
-    const result = await coordinator.orchestrateImport(options.shardDO, {
+    const result = await coordinator.orchestrateImport(namespace, {
       batches: [...perShard.values()],
       headers: forwardedHeaders
     });
@@ -966,7 +1274,129 @@ const buildIntrospectionAdminRoutes = (deps) => {
   };
 };
 
-const MIGRATE_PATH = "/_lunora/migrate";
+const KV_NAMESPACES_PATH = "/_lunora/admin/kv/namespaces";
+const KV_KEYS_PATH = "/_lunora/admin/kv/keys";
+const KV_VALUE_PATH = "/_lunora/admin/kv/value";
+const KV_VALUE_MAX_BODY_BYTES = 32 * 1048576;
+const KV_MIN_EXPIRATION_SECONDS = 60;
+const buildKvAdminRoutes = (deps) => {
+  const { readJsonBody, requireAdminOption } = deps;
+  const gate = (request) => requireAdminOption(request, deps.kvIntrospector, {
+    code: "KV_NOT_CONFIGURED",
+    message: "KV endpoints require a `kvIntrospector` on the worker"
+  });
+  const ok = (payload) => Response.json(payload, { headers: { "content-type": "application/json" }, status: 200 });
+  const requireNamespaceAndKey = (request, verb) => {
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    const key = url.searchParams.get("key") ?? "";
+    if (namespace === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`namespace\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    if (key === "") {
+      throw new LunoraError(`KV-value ${verb} request requires a \`key\` query parameter`, { code: "BAD_REQUEST", status: 400 });
+    }
+    return { key, namespace };
+  };
+  const requireKnownNamespace = async (introspector, namespace) => {
+    const namespaces = await introspector.listNamespaces();
+    if (!namespaces.some((entry) => entry.binding === namespace)) {
+      throw new LunoraError(`Unknown KV namespace binding \`${namespace}\``, { code: "NOT_FOUND", status: 404 });
+    }
+  };
+  const handleKvNamespaces = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-namespaces endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return ok({ namespaces: await gate(request).listNamespaces() });
+  };
+  const handleKvKeys = async (request) => {
+    if (request.method !== "GET") {
+      throw new LunoraError("KV-keys endpoint requires GET", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const introspector = gate(request);
+    const url = new URL(request.url);
+    const namespace = url.searchParams.get("namespace") ?? "";
+    if (namespace === "") {
+      throw new LunoraError("KV-keys request requires a `namespace` query parameter", { code: "BAD_REQUEST", status: 400 });
+    }
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const cursor = url.searchParams.get("cursor") ?? void 0;
+    const limitRaw = url.searchParams.get("limit");
+    const parsedLimit = limitRaw === null ? void 0 : Number.parseInt(limitRaw, 10);
+    if (parsedLimit !== void 0 && (!Number.isInteger(parsedLimit) || parsedLimit < 1)) {
+      throw new LunoraError("KV-keys `limit` must be a positive integer", { code: "BAD_REQUEST", status: 400 });
+    }
+    const limit = parsedLimit === void 0 ? void 0 : Math.min(parsedLimit, 1e3);
+    await requireKnownNamespace(introspector, namespace);
+    return ok(await introspector.listKeys({ cursor, limit, namespace, prefix }));
+  };
+  const handleKvValueGet = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "GET");
+    await requireKnownNamespace(introspector, params.namespace);
+    return ok(await introspector.getValue(params));
+  };
+  const handleKvValuePut = async (request) => {
+    const introspector = gate(request);
+    const candidate = await readJsonBody(request, KV_VALUE_MAX_BODY_BYTES);
+    if (typeof candidate.namespace !== "string" || candidate.namespace === "") {
+      throw new LunoraError("KV-value PUT request requires a `namespace` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.key !== "string" || candidate.key === "") {
+      throw new LunoraError("KV-value PUT request requires a `key` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof candidate.value !== "string") {
+      throw new LunoraError("KV-value PUT request requires a `value` string", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (candidate.expirationTtl !== void 0 && (typeof candidate.expirationTtl !== "number" || !Number.isInteger(candidate.expirationTtl) || candidate.expirationTtl < KV_MIN_EXPIRATION_SECONDS)) {
+      throw new LunoraError("KV-value PUT `expirationTtl` must be an integer ≥ 60", { code: "BAD_REQUEST", status: 400 });
+    }
+    const minExpiration = Math.floor(Date.now() / 1e3) + KV_MIN_EXPIRATION_SECONDS;
+    if (candidate.expiration !== void 0 && (typeof candidate.expiration !== "number" || !Number.isInteger(candidate.expiration) || candidate.expiration < minExpiration)) {
+      throw new LunoraError("KV-value PUT `expiration` must be a Unix-seconds timestamp at least 60 seconds in the future", {
+        code: "BAD_REQUEST",
+        status: 400
+      });
+    }
+    await requireKnownNamespace(introspector, candidate.namespace);
+    await introspector.putValue({
+      expiration: candidate.expiration,
+      expirationTtl: candidate.expirationTtl,
+      key: candidate.key,
+      metadata: candidate.metadata,
+      namespace: candidate.namespace,
+      value: candidate.value
+    });
+    return ok({ ok: true });
+  };
+  const handleKvValueDelete = async (request) => {
+    const introspector = gate(request);
+    const params = requireNamespaceAndKey(request, "DELETE");
+    await requireKnownNamespace(introspector, params.namespace);
+    await introspector.deleteKey(params);
+    return ok({ deleted: true });
+  };
+  const kvValueHandlers = {
+    DELETE: handleKvValueDelete,
+    GET: handleKvValueGet,
+    PUT: handleKvValuePut
+  };
+  const handleKvValue = (request) => {
+    const handler = kvValueHandlers[request.method];
+    if (!handler) {
+      throw new LunoraError("KV-value endpoint requires GET, PUT, or DELETE", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    return handler(request);
+  };
+  return {
+    [KV_NAMESPACES_PATH]: handleKvNamespaces,
+    [KV_KEYS_PATH]: handleKvKeys,
+    [KV_VALUE_PATH]: handleKvValue
+  };
+};
+
+const MIGRATE_PATH$1 = "/_lunora/migrate";
 const PITR_PATH = "/_lunora/admin/pitr";
 const RANK_PATH = "/_lunora/admin/rank";
 const RANKPAGE_PATH = "/_lunora/admin/rankpage";
@@ -1223,7 +1653,7 @@ const buildOrchestrationAdminRoutes = (deps) => {
     return forwardToShard(shardDO, pitr.shardKey ?? defaultShard, forwarded);
   };
   return {
-    [MIGRATE_PATH]: handleMigrate,
+    [MIGRATE_PATH$1]: handleMigrate,
     [PITR_PATH]: handlePitr,
     [RANK_PATH]: handleRank,
     [RANKPAGE_PATH]: handleRankPage,
@@ -1254,11 +1684,11 @@ const buildScheduledAdminRoutes = (deps) => {
     const stub = resolveSchedulerStub(request);
     return stub.fetch(new Request("https://scheduler.internal/status", { method: "GET" }));
   };
-  const handleScheduledWebSocket = (request) => {
+  const handleScheduledWebSocket = async (request) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
-    if (!checkWsAdmin(request)) {
+    if (!await checkWsAdmin(request)) {
       throw new LunoraError("admin authorization required", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     const namespace = requireSchedulerNamespace();
@@ -1502,7 +1932,7 @@ const buildWorkflowsAdminRoutes = (deps) => {
     assertAdmin(request);
     const client = resolveWorkflowsClient(env);
     if (!client) {
-      return throwNotConfigured();
+      return Response.json({ configured: false, instances: [], page: 1, perPage: 0, totalCount: 0 });
     }
     const workflowName = requireQuery(url, "name");
     const status = toInstanceStatus(url.searchParams.get("status"));
@@ -1554,9 +1984,28 @@ const buildWorkflowsAdminRoutes = (deps) => {
 
 const NDJSON_ENCODER = new TextEncoder();
 const RPC_PATH = "/_lunora/rpc";
+const RPC_BATCH_PATH = "/_lunora/rpc-batch";
 const WS_PATH = "/_lunora/ws";
+const VOICE_PATH_PREFIX = "/_lunora/voice/";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
+const ADMIN_WS_TOKEN_PATH = "/_lunora/admin/ws-token";
+const ADMIN_PATH_PREFIX = "/_lunora/admin/";
+const MIGRATE_PATH = "/_lunora/migrate";
+const STATUS_PATH = "/_lunora/status";
+const isAdminPath = (pathname) => pathname.startsWith(ADMIN_PATH_PREFIX) || pathname === MIGRATE_PATH;
+const REQUIRE_EPHEMERAL_ENV_VALUES = /* @__PURE__ */ new Set(["1", "enabled", "on", "true", "yes"]);
+const readForwardedIdentity = (request) => {
+  const forwardedUserId = request.headers.get("x-lunora-userid");
+  const forwardedIdentity = request.headers.get("x-lunora-identity");
+  if (forwardedUserId === null && forwardedIdentity === null) {
+    return void 0;
+  }
+  return {
+    ...forwardedIdentity === null ? {} : { identity: forwardedIdentity },
+    ...forwardedUserId === null ? {} : { userId: forwardedUserId }
+  };
+};
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
@@ -1569,7 +2018,7 @@ const isAuthAttemptPath = (pathname, basePath) => {
   return AUTH_ATTEMPT_SEGMENTS.some((segment) => suffix === segment || suffix.startsWith(`${segment}/`));
 };
 const buildErrorEvent = (functionPath, durationMs, error, extra) => {
-  const mappable = error instanceof LunoraError || isStructuralLunoraError(error) || isStructuralConflictError(error);
+  const mappable = isLunoraError(error);
   const code = mappable ? error.code : "INTERNAL_SERVER_ERROR";
   const status = mappable ? error.status : 500;
   const message = error instanceof Error ? error.message : String(error);
@@ -1598,6 +2047,8 @@ const resolveForwardContext = async (request, env, resolveIdentity) => {
   const cookie = request.headers.get("cookie");
   const bookmark = request.headers.get("x-d1-bookmark");
   const mutationId = request.headers.get("x-lunora-mutation-id");
+  const clientId = request.headers.get("x-lunora-client-id");
+  const clientSeq = request.headers.get("x-lunora-client-seq");
   if (authorization) {
     headers["authorization"] = authorization;
   }
@@ -1610,6 +2061,12 @@ const resolveForwardContext = async (request, env, resolveIdentity) => {
   if (mutationId) {
     headers["x-lunora-mutation-id"] = mutationId;
   }
+  if (clientId) {
+    headers["x-lunora-client-id"] = clientId;
+  }
+  if (clientSeq) {
+    headers["x-lunora-client-seq"] = clientSeq;
+  }
   const clientIp = request.headers.get("cf-connecting-ip");
   if (clientIp) {
     headers["x-lunora-client-ip"] = clientIp;
@@ -1662,6 +2119,28 @@ const validateFanOut = (fanOut) => {
   }
   return spec;
 };
+const logRpcDebug = (env, envelope) => {
+  if (!env?.LUNORA_DEBUG_RPC) {
+    return;
+  }
+  console.warn(`[lunora:rpc] ${envelope.fanOut ? "fan-out" : `shard=${envelope.shardKey ?? "(root)"}`} ${envelope.functionPath}`);
+};
+const resolveX402Charge = (envelope, options) => {
+  const x402Tag = options.functions?.[envelope.functionPath]?.x402;
+  if (!x402Tag) {
+    return void 0;
+  }
+  if (envelope.fanOut) {
+    throw new LunoraError("a paid (`.x402`) function cannot be fanned out", { code: "BAD_REQUEST", status: 400 });
+  }
+  if (!options.x402Charge) {
+    throw new LunoraError(`function "${envelope.functionPath}" is marked paid (.x402) but no x402Charge gate is configured on the worker`, {
+      code: "MISCONFIGURED",
+      status: 500
+    });
+  }
+  return x402Tag;
+};
 const parseEnvelope = async (request) => {
   const text = await readBodyTextWithLimit(request);
   let body;
@@ -1681,9 +2160,18 @@ const parseEnvelope = async (request) => {
     throw new LunoraError("RPC `shardKey` must be a string", { code: "BAD_REQUEST", status: 400 });
   }
   const envelope = body;
+  const fanOut = validateFanOut(envelope.fanOut);
+  const args = envelope.args ?? {};
+  if (fanOut && envelope.functionPath.startsWith("__lunora_relation__:")) {
+    const requestedTable = args.table;
+    if (typeof requestedTable === "string" && requestedTable !== fanOut.table) {
+      throw new LunoraError("RPC `args.table` must match the authorized `fanOut.table` for a relation fan-out", { code: "BAD_REQUEST", status: 400 });
+    }
+    args.table = fanOut.table;
+  }
   return {
-    args: envelope.args ?? {},
-    fanOut: validateFanOut(envelope.fanOut),
+    args,
+    fanOut,
     functionPath: envelope.functionPath,
     shardKey: envelope.shardKey
   };
@@ -1692,6 +2180,46 @@ const forwardToShard = async (namespace, shardKey, request) => {
   const stub = resolveShard(namespace, shardKey);
   return stub.fetch(request);
 };
+const relayProbeCache = /* @__PURE__ */ new Map();
+const RELAY_PROBE_TTL_MS = 5e3;
+const RELAY_PROBE_MAX_ENTRIES = 4096;
+const probeRelayCount = async (namespace, shardKey) => {
+  const now = Date.now();
+  const cached = relayProbeCache.get(shardKey);
+  if (cached !== void 0 && cached.expiresMs > now) {
+    return cached.relayCount;
+  }
+  if (cached !== void 0) {
+    relayProbeCache.delete(shardKey);
+  }
+  let relayCount = 0;
+  try {
+    const response = await resolveShard(namespace, shardKey).fetch(new Request("https://shard.internal/_lunora/route"));
+    if (response.ok) {
+      const body = await response.json();
+      const reported = body.relayCount;
+      if (typeof reported === "number" && reported > 0) {
+        relayCount = Math.floor(reported);
+      }
+    }
+  } catch {
+    relayCount = 0;
+  }
+  evictOldestEntry(relayProbeCache, RELAY_PROBE_MAX_ENTRIES);
+  relayProbeCache.set(shardKey, { expiresMs: now + RELAY_PROBE_TTL_MS, relayCount });
+  return relayCount;
+};
+const resolveShardBindingName = (env, namespace) => {
+  if (env === null || typeof env !== "object") {
+    return void 0;
+  }
+  for (const [key, value] of Object.entries(env)) {
+    if (value === namespace) {
+      return key;
+    }
+  }
+  return void 0;
+};
 const constantTimeEqual = (expected, supplied) => {
   const max = Math.max(expected.length, supplied.length);
   let diff = expected.length ^ supplied.length;
@@ -1731,77 +2259,123 @@ const checkAdminAuth = (request, expected) => {
   }
   return constantTimeEqual(expected, rest.join(" ").trim());
 };
-const checkAdminWsToken = (request, expected) => {
+const checkAdminWsToken = async (request, expected, requireEphemeral) => {
   if (!expected || expected.length === 0) {
     return false;
   }
   const supplied = new URL(request.url).searchParams.get("token");
-  return supplied !== null && constantTimeEqual(expected, supplied);
+  if (supplied === null) {
+    return false;
+  }
+  if (await verifyWsAdminToken(expected, supplied)) {
+    return true;
+  }
+  if (requireEphemeral) {
+    return false;
+  }
+  return constantTimeEqual(expected, supplied);
 };
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
+  const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
+  const shardDO = applyJurisdiction(options.shardDO, options.jurisdiction);
+  const schedulerDO = options.schedulerDO === void 0 ? void 0 : applyJurisdiction(options.schedulerDO, options.jurisdiction);
   let envAdminToken;
   const effectiveAdminToken = () => options.adminToken ?? envAdminToken;
+  let envRequireEphemeralWsToken;
+  const effectiveRequireEphemeralWsToken = () => options.requireEphemeralWsToken ?? envRequireEphemeralWsToken ?? false;
   const resolveAdminTokenFromEnv = (env) => {
+    const record = env ?? {};
+    if (envRequireEphemeralWsToken === void 0 && options.requireEphemeralWsToken === void 0) {
+      const raw = record["LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN"];
+      if (typeof raw === "string" && raw.length > 0) {
+        envRequireEphemeralWsToken = REQUIRE_EPHEMERAL_ENV_VALUES.has(raw.trim().toLowerCase());
+      }
+    }
     if (envAdminToken !== void 0 || options.adminToken !== void 0) {
       return;
     }
-    const value = (env ?? {})["LUNORA_ADMIN_TOKEN"];
+    const value = record["LUNORA_ADMIN_TOKEN"];
     if (typeof value === "string" && value.length > 0) {
       envAdminToken = value;
     }
   };
-  const hasAnyShardAuth = Boolean(options.authorizeShard) || Boolean(options.authorizeFanOut);
+  const accessAdminGrants = /* @__PURE__ */ new WeakSet();
+  const requestIsAdmin = (request) => checkAdminAuth(request, effectiveAdminToken()) || accessAdminGrants.has(request);
+  const resolveAdminForwardContext = async (request, env) => {
+    const context = await resolveForwardContext(request, env, options.resolveIdentity);
+    if (accessAdminGrants.has(request) && context.headers["authorization"] === void 0) {
+      const token = effectiveAdminToken();
+      if (token !== void 0) {
+        context.headers["authorization"] = `Bearer ${token}`;
+      }
+    }
+    return context;
+  };
   let warnedUnauthenticatedShardAccess = false;
-  const warnUnauthenticatedShardAccessOnce = (kind) => {
-    if (hasAnyShardAuth || options.allowUnauthenticatedShardAccess || warnedUnauthenticatedShardAccess) {
+  const guardUnauthenticatedShardAccess = (kind) => {
+    if (!options.allowUnauthenticatedShardAccess) {
+      const callback = kind === "fan-out" ? "authorizeFanOut" : "authorizeShard";
+      throw new LunoraError(
+        `${kind} access is default-denied: configure \`${callback}\` on the worker, or set \`allowUnauthenticatedShardAccess: true\` to explicitly allow unauthenticated ${kind} access (relying solely on per-row RLS).`,
+        { code: kind === "fan-out" ? "FORBIDDEN_FANOUT" : "FORBIDDEN_SHARD", status: 403 }
+      );
+    }
+    if (warnedUnauthenticatedShardAccess) {
       return;
     }
     warnedUnauthenticatedShardAccess = true;
     console.warn(
       [
-        `[lunora] SECURITY: received ${kind} access but neither \`authorizeShard\` nor \`authorizeFanOut\` is configured — `,
+        `[lunora] SECURITY: serving ${kind} access with \`allowUnauthenticatedShardAccess: true\` and no \`authorizeShard\`/\`authorizeFanOut\` — `,
         `any caller (including unauthenticated ones) can target any shard / fan out across the table. `,
-        `Configure \`authorizeShard\`/\`authorizeFanOut\`, or set \`allowUnauthenticatedShardAccess: true\` to acknowledge this posture and silence this warning.`
+        `This is safe only if every table is protected by per-row RLS. Configure \`authorizeShard\`/\`authorizeFanOut\` to gate it.`
       ].join("")
     );
   };
   const orchestrationAdminRoutes = buildOrchestrationAdminRoutes({
     defaultShard,
     forwardToShard,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
-    shardDO: options.shardDO
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO
   });
-  const dispatchToShard = async (functionPath, args, shardKey) => {
+  const dispatchToShard = async (functionPath, args, shardKey, mutationId, forwardedIdentity) => {
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(null, shardKey);
       if (!allowed) {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     }
+    const headers = { "content-type": "application/json", "x-lunora-system": "1" };
+    if (forwardedIdentity?.userId !== void 0 && forwardedIdentity.userId.length > 0) {
+      headers["x-lunora-userid"] = forwardedIdentity.userId;
+    }
+    if (forwardedIdentity?.identity !== void 0 && forwardedIdentity.identity.length > 0) {
+      headers["x-lunora-identity"] = forwardedIdentity.identity;
+    }
+    if (mutationId !== void 0 && mutationId.length > 0) {
+      headers["x-lunora-mutation-id"] = mutationId;
+    }
     const forwarded = new Request("https://shard.internal/rpc", {
-      // `x-lunora-system` marks this as a trusted server-initiated dispatch
-      // so the shard may run `internal` functions (scheduled/cron jobs are
-      // typically internal). Authorization was already enforced above; this
-      // header is set only here, never on the client RPC path.
       body: JSON.stringify({ args, functionPath }),
-      headers: { "content-type": "application/json", "x-lunora-system": "1" },
+      headers,
       method: "POST"
     });
-    return forwardToShard(options.shardDO, shardKey, forwarded);
+    return forwardToShard(shardDO, shardKey, forwarded);
   };
-  const startCronWorkflow = async (binding, job, env) => {
+  const startWorkflowInstance = async (binding, args, env, label) => {
     const candidate = env?.[binding];
     if (!candidate || typeof candidate.create !== "function") {
-      throw new LunoraError(`cron job "${job.name}" targets workflow binding "${binding}", which is not bound on env`, {
+      throw new LunoraError(`${label} targets workflow binding "${binding}", which is not bound on env`, {
         code: "CRON_JOB_FAILED",
         status: 500
       });
     }
-    await candidate.create({ params: job.args ?? {} });
+    await candidate.create({ params: args });
   };
+  const startCronWorkflow = async (binding, job, env) => startWorkflowInstance(binding, job.args ?? {}, env, `cron job "${job.name}"`);
   const runOneCronJob = async (job, env) => {
     if (job.workflow) {
       await startCronWorkflow(job.workflow, job, env);
@@ -1835,7 +2409,7 @@ const createWorker = (options) => {
     }
   };
   const handleRunCronJob = async (request, env) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
     if (request.method !== "POST") {
@@ -1858,12 +2432,12 @@ const createWorker = (options) => {
   };
   const releasePoolSlot = async (candidate) => {
     const pool = typeof candidate.pool === "string" && candidate.pool.length > 0 ? candidate.pool : void 0;
-    if (!pool || !options.schedulerDO || typeof candidate.id !== "string") {
+    if (!pool || !schedulerDO || typeof candidate.id !== "string") {
       return;
     }
     const instanceName = typeof candidate.instanceName === "string" && candidate.instanceName.length > 0 ? candidate.instanceName : "default";
     try {
-      await options.schedulerDO.get(options.schedulerDO.idFromName(instanceName)).fetch(
+      await schedulerDO.get(schedulerDO.idFromName(instanceName)).fetch(
         new Request("https://scheduler.internal/complete", {
           body: JSON.stringify({ id: candidate.id, pool }),
           headers: { "content-type": "application/json" },
@@ -1898,28 +2472,34 @@ const createWorker = (options) => {
       throw new LunoraError("Scheduler dispatch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
     }
     const candidate = body ?? {};
+    const args = candidate.args ?? {};
+    if (typeof candidate.workflow === "string" && candidate.workflow.length > 0) {
+      await startWorkflowInstance(candidate.workflow, args, env, "scheduled workflow");
+      return Response.json({ ok: true }, { status: 200 });
+    }
     if (typeof candidate.functionPath !== "string" || candidate.functionPath.length === 0) {
       throw new LunoraError("Scheduler dispatch is missing `functionPath`", { code: "BAD_REQUEST", status: 400 });
     }
-    const args = candidate.args ?? {};
     const shardKey = typeof candidate.shardKey === "string" && candidate.shardKey.length > 0 ? candidate.shardKey : defaultShard;
-    const response = await dispatchToShard(candidate.functionPath, args, shardKey);
+    const mutationId = typeof candidate.id === "string" && candidate.id.length > 0 ? candidate.id : void 0;
+    const identity = readForwardedIdentity(request);
+    const response = await dispatchToShard(candidate.functionPath, args, shardKey, mutationId, identity);
     await releasePoolSlot(candidate);
     return response;
   };
   const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
     applyGlobals: options.applyGlobals,
-    isAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()),
+    isAdmin: requestIsAdmin,
     knownTables: () => collectKnownTables(),
     queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: (request, env) => resolveForwardContext(request, env, options.resolveIdentity),
-    shardDO: options.shardDO,
-    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow),
-    streamingImport: (request, headers) => streamingImport(request, options, headers),
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO,
+    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
+    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
     syncGlobals: options.syncGlobals
   });
   const assertAdminAuthorized = (request) => {
-    if (!checkAdminAuth(request, effectiveAdminToken())) {
+    if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
     }
   };
@@ -1946,17 +2526,17 @@ const createWorker = (options) => {
     };
   };
   const requireSchedulerNamespace = () => {
-    if (options.schedulerDO === void 0) {
+    if (schedulerDO === void 0) {
       throw new LunoraError("scheduled endpoints require a `schedulerDO` namespace on the worker", { code: "SCHEDULER_NOT_CONFIGURED", status: 400 });
     }
-    return options.schedulerDO;
+    return schedulerDO;
   };
   const resolveSchedulerStub = (request) => {
     assertAdminAuthorized(request);
     return resolveShard(requireSchedulerNamespace(), options.schedulerInstanceName ?? "default");
   };
   const scheduledAdminRoutes = buildScheduledAdminRoutes({
-    checkWsAdmin: (request) => checkAdminAuth(request, effectiveAdminToken()) || checkAdminWsToken(request, effectiveAdminToken()),
+    checkWsAdmin: async (request) => requestIsAdmin(request) || checkAdminWsToken(request, effectiveAdminToken(), effectiveRequireEphemeralWsToken()),
     requireSchedulerNamespace,
     resolveSchedulerStub,
     schedulerInstanceName: options.schedulerInstanceName ?? "default"
@@ -1984,6 +2564,11 @@ const createWorker = (options) => {
     requireAdminOption,
     vectorIntrospector: options.vectorIntrospector
   });
+  const kvAdminRoutes = buildKvAdminRoutes({
+    kvIntrospector: options.kvIntrospector,
+    readJsonBody: readJsonBodyWithLimit,
+    requireAdminOption
+  });
   const introspectionAdminRoutes = buildIntrospectionAdminRoutes({
     assertAdmin: assertAdminAuthorized,
     options: {
@@ -1997,8 +2582,8 @@ const createWorker = (options) => {
     queryParameter,
     requireAdminOption
   });
-  const buildHttpActionContext = async (request, env) => {
-    const { claims, headers, userId } = await resolveForwardContext(request, env, options.resolveIdentity);
+  const buildHttpActionContext = async (request, env, context) => {
+    const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
     const run = async (reference, args = {}) => {
       const functionPath = reference.__lunoraRef;
       if (typeof functionPath !== "string") {
@@ -2009,7 +2594,7 @@ const createWorker = (options) => {
         headers,
         method: "POST"
       });
-      const response = await forwardToShard(options.shardDO, defaultShard, forwarded);
+      const response = await forwardToShard(shardDO, defaultShard, forwarded);
       const payload = await response.json();
       if (payload.error) {
         throw new LunoraError(payload.error.message ?? "shard RPC failed", {
@@ -2024,6 +2609,7 @@ const createWorker = (options) => {
         getIdentity: () => Promise.resolve(claims),
         userId
       },
+      cache: context.cache,
       fetch: globalThis.fetch.bind(globalThis),
       runAction: run,
       runMutation: run,
@@ -2034,7 +2620,7 @@ const createWorker = (options) => {
     if (!options.httpRouter) {
       return void 0;
     }
-    const httpContext = await buildHttpActionContext(request, env);
+    const httpContext = await buildHttpActionContext(request, env, context);
     try {
       return await options.httpRouter.fetch(request, { ...env, __lunoraCtx: httpContext }, context);
     } catch (error) {
@@ -2046,15 +2632,84 @@ const createWorker = (options) => {
     if (request.headers.get("Upgrade") !== "websocket") {
       throw new LunoraError("WebSocket upgrade header missing", { code: "BAD_REQUEST", status: 426 });
     }
+    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
+    if (blockedUpgrade) {
+      return blockedUpgrade;
+    }
     const shardKey = url.searchParams.get("shard") ?? defaultShard;
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     if (options.authorizeShard) {
       const allowed = await options.authorizeShard(identity, shardKey);
       if (!allowed) {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
+    }
+    const upgradeHeaders = new Headers(request.headers);
+    const clientHeaderNames = [...upgradeHeaders.keys()];
+    for (const name of clientHeaderNames) {
+      if (name.startsWith("x-lunora-")) {
+        upgradeHeaders.delete(name);
+      }
+    }
+    const forwardedUserId = forwardedHeaders["x-lunora-userid"];
+    const forwardedIdentity = forwardedHeaders["x-lunora-identity"];
+    const forwardedExp = forwardedHeaders["x-lunora-identity-exp"];
+    if (forwardedUserId !== void 0) {
+      upgradeHeaders.set("x-lunora-userid", forwardedUserId);
+    }
+    if (forwardedIdentity !== void 0) {
+      upgradeHeaders.set("x-lunora-identity", forwardedIdentity);
+    }
+    if (forwardedExp !== void 0) {
+      upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
+    }
+    const binding = resolveShardBindingName(env, options.shardDO);
+    if (binding !== void 0) {
+      upgradeHeaders.set("x-lunora-shard-binding", binding);
+      const relayCount = await probeRelayCount(shardDO, shardKey);
+      if (relayCount > 0) {
+        const target = relayName(shardKey, Math.floor(Math.random() * relayCount));
+        return forwardToShard(shardDO, target, new Request(request, { headers: upgradeHeaders }));
+      }
+    }
+    return forwardToShard(shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
+  };
+  const handleVoiceUpgrade = async (request, env, url) => {
+    const { voiceAgents } = options;
+    if (voiceAgents === void 0) {
+      return new Response("Not found", { status: 404 });
+    }
+    if (request.headers.get("Upgrade") !== "websocket") {
+      return new Response("Expected a WebSocket upgrade", { headers: { allow: "GET" }, status: 426 });
+    }
+    const blockedUpgrade = enforceWebSocketOrigin(request, resolvedSecurity);
+    if (blockedUpgrade) {
+      return blockedUpgrade;
+    }
+    let agentName;
+    try {
+      agentName = decodeURIComponent(url.pathname.slice(VOICE_PATH_PREFIX.length));
+    } catch {
+      return new Response("Unknown voice agent", { status: 404 });
+    }
+    const namespace = Object.hasOwn(voiceAgents, agentName) ? voiceAgents[agentName] : void 0;
+    if (namespace === void 0) {
+      return new Response("Unknown voice agent", { status: 404 });
+    }
+    const threadKey = url.searchParams.get("threadKey");
+    if (threadKey === null || threadKey.length === 0) {
+      return new Response("Missing threadKey", { status: 400 });
+    }
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
+    if (options.authorizeShard) {
+      const allowed = await options.authorizeShard(identity, threadKey);
+      if (!allowed) {
+        return new Response("Forbidden", { status: 403 });
+      }
+    } else {
+      guardUnauthenticatedShardAccess("shard");
     }
     const upgradeHeaders = new Headers(request.headers);
     upgradeHeaders.delete("x-lunora-userid");
@@ -2072,31 +2727,36 @@ const createWorker = (options) => {
     if (forwardedExp !== void 0) {
       upgradeHeaders.set("x-lunora-identity-exp", forwardedExp);
     }
-    return forwardToShard(options.shardDO, shardKey, new Request(request, { headers: upgradeHeaders }));
+    return forwardToShard(namespace, threadKey, new Request(request, { headers: upgradeHeaders }));
+  };
+  const authorizeFanOutEnvelope = async (fanOut, functionPath, identity) => {
+    if (options.authorizeFanOut) {
+      const allowed = await options.authorizeFanOut(identity, fanOut.table, functionPath);
+      if (!allowed) {
+        throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
+      }
+      return;
+    }
+    if (functionPath.startsWith("__lunora_relation__:")) {
+      throw new LunoraError("reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    if (options.authorizeShard) {
+      throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
+        code: "FORBIDDEN_FANOUT",
+        status: 403
+      });
+    }
+    guardUnauthenticatedShardAccess("fan-out");
   };
   const authorizeRpcEnvelope = async (envelope, identity) => {
+    if (!envelope.fanOut && envelope.functionPath.startsWith("__lunora_admin__:")) {
+      return;
+    }
     if (envelope.fanOut) {
-      if (options.authorizeFanOut) {
-        const allowed = await options.authorizeFanOut(identity, envelope.fanOut.table, envelope.functionPath);
-        if (!allowed) {
-          throw new LunoraError("Forbidden fan-out", { code: "FORBIDDEN_FANOUT", status: 403 });
-        }
-      } else if (envelope.functionPath.startsWith("__lunora_relation__:")) {
-        throw new LunoraError(
-          "reverse cross-backend relation reads (`__lunora_relation__:*`) require `authorizeFanOut` to be configured on the worker",
-          {
-            code: "FORBIDDEN_FANOUT",
-            status: 403
-          }
-        );
-      } else if (options.authorizeShard) {
-        throw new LunoraError("Fan-out requires `authorizeFanOut` to be configured on the worker when `authorizeShard` is set", {
-          code: "FORBIDDEN_FANOUT",
-          status: 403
-        });
-      } else {
-        warnUnauthenticatedShardAccessOnce("fan-out");
-      }
+      await authorizeFanOutEnvelope(envelope.fanOut, envelope.functionPath, identity);
       return;
     }
     if (options.authorizeShard) {
@@ -2106,19 +2766,21 @@ const createWorker = (options) => {
         throw new LunoraError("Forbidden shard", { code: "FORBIDDEN_SHARD", status: 403 });
       }
     } else if (envelope.shardKey !== void 0 && envelope.shardKey !== defaultShard) {
-      warnUnauthenticatedShardAccessOnce("shard");
+      guardUnauthenticatedShardAccess("shard");
     }
   };
   const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
     const rpcStartedAt = Date.now();
     const { observability } = options;
+    const traceId = otlpRandomHex(16);
+    const spanId = otlpRandomHex(8);
     const forwarded = new Request(`https://shard.internal/rpc`, {
       body: JSON.stringify({ args, functionPath }),
-      headers: forwardedHeaders,
+      headers: { ...forwardedHeaders, traceparent: buildTraceparent(traceId, spanId) },
       method: "POST"
     });
     try {
-      const response = await forwardToShard(options.shardDO, shardKey, forwarded);
+      const response = await forwardToShard(shardDO, shardKey, forwarded);
       emitRpcEvent(
         observability,
         {
@@ -2126,19 +2788,15 @@ const createWorker = (options) => {
           functionPath,
           ok: response.ok,
           shardKey,
+          spanId,
+          traceId,
           ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
         },
         sinkContext
       );
-      const responseBookmark = response.headers.get("x-d1-bookmark");
-      if (responseBookmark) {
-        const headers = new Headers(response.headers);
-        headers.set("x-d1-bookmark", responseBookmark);
-        return new Response(response.body, { headers, status: response.status });
-      }
       return response;
     } catch (error) {
-      emitRpcEvent(observability, buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), sinkContext);
+      emitRpcEvent(observability, { ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), spanId, traceId }, sinkContext);
       throw error;
     }
   };
@@ -2147,6 +2805,7 @@ const createWorker = (options) => {
       throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
     }
     const envelope = await parseEnvelope(request);
+    logRpcDebug(env, envelope);
     if (envelope.fanOut && envelope.shardKey) {
       throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
     }
@@ -2162,14 +2821,15 @@ const createWorker = (options) => {
         status: 400
       });
     }
-    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
+    const x402Tag = resolveX402Charge(envelope, options);
     {
       const rpcStartedAt = Date.now();
       const { observability } = options;
       const sinkContext = context ? {
         waitUntil: (promise) => {
-          context.waitUntil(promise);
+          context.waitUntil?.(promise);
         }
       } : void 0;
       if (envelope.fanOut) {
@@ -2181,7 +2841,7 @@ const createWorker = (options) => {
           });
         }
         try {
-          const result = await coordinator.fanOut(options.shardDO, {
+          const result = await coordinator.fanOut(shardDO, {
             args: envelope.args ?? {},
             fanOut: envelope.fanOut,
             functionPath: envelope.functionPath,
@@ -2215,16 +2875,153 @@ const createWorker = (options) => {
         }
       }
       const shardKey = envelope.shardKey ?? defaultShard;
-      return dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+      const dispatch = () => dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+      if (x402Tag && options.x402Charge) {
+        return options.x402Charge(request, { functionPath: envelope.functionPath, price: x402Tag.price }, dispatch);
+      }
+      return dispatch();
     }
   };
+  const handleBatchRpc = async (request, env, context) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("RPC batch endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const text = await readBodyTextWithLimit(request);
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new LunoraError("RPC batch body must be valid JSON", { code: "BAD_REQUEST", status: 400 });
+    }
+    if (typeof body !== "object" || body === null || Array.isArray(body)) {
+      throw new LunoraError("RPC batch body must be an object", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { calls } = body;
+    if (!Array.isArray(calls)) {
+      throw new LunoraError("RPC batch `calls` must be an array", { code: "BAD_REQUEST", status: 400 });
+    }
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
+    const groups = groupBatchCallsByShard(calls, defaultShard);
+    for (const entries of groups.values()) {
+      for (const entry of entries) {
+        if (options.functions?.[entry.functionPath]?.x402) {
+          throw new LunoraError(
+            `paid (\`.x402\`) function "${entry.functionPath}" cannot be called in a batch; dispatch it individually over ${RPC_PATH}`,
+            {
+              code: "BAD_REQUEST",
+              status: 400
+            }
+          );
+        }
+      }
+    }
+    await Promise.all(
+      [...groups.entries()].flatMap(
+        ([shardKey, entries]) => entries.map((entry) => authorizeRpcEnvelope({ functionPath: entry.functionPath, shardKey }, identity))
+      )
+    );
+    const { observability } = options;
+    const sinkContext = context ? {
+      waitUntil: (promise) => {
+        context.waitUntil?.(promise);
+      }
+    } : void 0;
+    const results = [];
+    const bookmarks = [];
+    const slotError = (entry, status, code, message) => {
+      return { body: { error: { code, message } }, id: entry.id, status };
+    };
+    const failSubBatch = (entries, status, code, message, eventFor) => {
+      for (const entry of entries) {
+        emitRpcEvent(observability, eventFor(entry), sinkContext);
+        results.push(slotError(entry, status, code, message));
+      }
+    };
+    const emitEntryEvents = (entries, shardKey, durationMs, statusById, fallbackStatus) => {
+      for (const entry of entries) {
+        const status = statusById.get(entry.id) ?? fallbackStatus;
+        const ok = status < 400;
+        emitRpcEvent(
+          observability,
+          {
+            durationMs,
+            functionPath: entry.functionPath,
+            ok,
+            shardKey,
+            ...ok ? {} : { error: { code: "SHARD_ERROR", message: `batched call returned ${String(status)}`, status } }
+          },
+          sinkContext
+        );
+      }
+    };
+    await Promise.all(
+      [...groups.entries()].map(async ([shardKey, entries]) => {
+        const headers = new Headers(forwardedHeaders);
+        headers.set("content-type", "application/json");
+        const subRequest = new Request("https://shard.internal/rpc-batch", { body: JSON.stringify({ calls: entries }), headers, method: "POST" });
+        const subStartedAt = Date.now();
+        let response;
+        try {
+          response = await forwardToShard(shardDO, shardKey, subRequest);
+        } catch (error) {
+          const durationMs2 = Date.now() - subStartedAt;
+          const { body: errorBody } = toErrorBody(error, { fallbackCode: "SHARD_UNAVAILABLE", redactedMessage: "shard unavailable" });
+          failSubBatch(
+            entries,
+            502,
+            errorBody.code,
+            errorBody.message,
+            (entry) => buildErrorEvent(entry.functionPath, durationMs2, error, { shardKey })
+          );
+          return;
+        }
+        const durationMs = Date.now() - subStartedAt;
+        const bookmark = response.headers.get("x-d1-bookmark");
+        if (bookmark) {
+          bookmarks.push(bookmark);
+        }
+        let parsed;
+        try {
+          parsed = await response.json();
+        } catch {
+          const message = `shard batch returned a non-JSON response (${String(response.status)})`;
+          failSubBatch(entries, response.status, "SHARD_ERROR", message, (entry) => {
+            return {
+              durationMs,
+              error: { code: "SHARD_ERROR", message, status: response.status },
+              functionPath: entry.functionPath,
+              ok: false,
+              shardKey
+            };
+          });
+          return;
+        }
+        const entryResults = Array.isArray(parsed.results) ? parsed.results : [];
+        const statusById = new Map(entryResults.map((entry) => [entry.id, entry.status ?? response.status]));
+        const seenIds = new Set(entryResults.map((entry) => entry.id));
+        emitEntryEvents(entries, shardKey, durationMs, statusById, response.status);
+        results.push(...entryResults);
+        for (const entry of entries) {
+          if (!seenIds.has(entry.id)) {
+            results.push(slotError(entry, response.status, "SHARD_ERROR", `shard batch omitted result for call ${String(entry.id)}`));
+          }
+        }
+      })
+    );
+    const responseHeaders = { "content-type": "application/json" };
+    const [onlyBookmark] = bookmarks;
+    if (bookmarks.length === 1 && onlyBookmark !== void 0) {
+      responseHeaders["x-d1-bookmark"] = onlyBookmark;
+    }
+    return Response.json({ results }, { headers: responseHeaders, status: 200 });
+  };
   const serverQuery = async (request, env, reference, args = {}, callOptions = {}) => {
     try {
       const functionPath = reference.__lunoraRef;
       if (typeof functionPath !== "string") {
         throw new LunoraError("serverQuery: expected a function reference from the generated `api`", { code: "BAD_REQUEST", status: 400 });
       }
-      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, options.resolveIdentity);
+      const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
       await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
       const shardKey = callOptions.shardKey ?? defaultShard;
       return await dispatchSingleShard(functionPath, args, shardKey, forwardedHeaders);
@@ -2269,43 +3066,33 @@ const createWorker = (options) => {
     if (!coordinator) {
       throw new LunoraError("scheduled backup requires a `queryCoordinator` on the worker", { code: "BACKUP_NOT_CONFIGURED", status: 500 });
     }
-    if (!options.adminToken || options.adminToken.length === 0) {
-      throw new LunoraError("scheduled backup requires an `adminToken` to authenticate the per-shard export gate", {
+    const adminToken = effectiveAdminToken();
+    if (!adminToken || adminToken.length === 0) {
+      throw new LunoraError("scheduled backup requires an `adminToken` (or `env.LUNORA_ADMIN_TOKEN`) to authenticate the per-shard export gate", {
         code: "BACKUP_NOT_CONFIGURED",
         status: 500
       });
     }
-    const forwardedHeaders = { authorization: `Bearer ${options.adminToken}`, "content-type": "application/json" };
+    const forwardedHeaders = { authorization: `Bearer ${adminToken}`, "content-type": "application/json" };
     const tables = options.backupTables;
     let rows = 0;
     let bytes = 0;
-    let streamError;
-    const stream = new ReadableStream({
-      async pull(streamController) {
-        const writeRow = (row) => {
-          const encoded = NDJSON_ENCODER.encode(`${JSON.stringify(row)}
-`);
-          rows += 1;
-          bytes += encoded.byteLength;
-          streamController.enqueue(encoded);
-        };
-        try {
-          await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow);
-          streamController.close();
-        } catch (error) {
-          streamError = error instanceof Error ? error : new Error(String(error));
-          streamController.error(error);
-        }
-      }
-    });
+    const parts = [];
+    const writeRow = (row) => {
+      const line = `${JSON.stringify(row)}
+`;
+      rows += 1;
+      bytes += NDJSON_ENCODER.encode(line).byteLength;
+      parts.push(line);
+    };
+    await streamExportRows(options, coordinator, forwardedHeaders, tables, writeRow, shardDO);
     const prefix = options.backupPrefix ?? "backups/";
     const timestamp = new Date(controller.scheduledTime).toISOString();
     const fileKey = `${prefix}lunora-backup-${timestamp.replaceAll(/[.:]/gu, "-")}.ndjson`;
     const manifestKey = `${fileKey}.manifest.json`;
-    await store.put(fileKey, stream, { httpMetadata: { contentType: "application/x-ndjson" } });
-    if (streamError !== void 0) {
-      throw streamError;
-    }
+    await store.put(fileKey, new Blob(parts, { type: "application/x-ndjson" }), {
+      httpMetadata: { contentType: "application/x-ndjson" }
+    });
     const manifest = {
       bytes,
       createdAt: timestamp,
@@ -2321,6 +3108,7 @@ const createWorker = (options) => {
     await pruneBackups(store, prefix);
   };
   const handleScheduled = async (controller, env, context) => {
+    resolveAdminTokenFromEnv(env);
     const errors = [];
     const toError = (error) => error instanceof Error ? error : new Error(String(error));
     const userHandler = options.crons?.[controller.cron];
@@ -2359,7 +3147,7 @@ const createWorker = (options) => {
         headers: { authorization: `Bearer ${adminBearer}`, "content-type": "application/json" },
         method: "POST"
       });
-      await forwardToShard(options.shardDO, defaultShard, recordRequest);
+      await forwardToShard(shardDO, defaultShard, recordRequest);
     } catch {
     }
   };
@@ -2373,16 +3161,41 @@ const createWorker = (options) => {
     }
     const basePath = options.authBasePath ?? DEFAULT_AUTH_BASE_PATH;
     if (isAuthAttemptPath(url.pathname, basePath)) {
-      context.waitUntil(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
+      context.waitUntil?.(recordAuthAttempt(env, authResponse.status >= 400 ? "fail" : "ok"));
     }
     return authResponse;
   };
   const customRoutes = options.routes !== void 0 && Object.keys(options.routes).length > 0 ? options.routes : void 0;
   const internalRoutes = {
+    [STATUS_PATH]: (request) => {
+      if (request.method !== "GET" && request.method !== "HEAD") {
+        return new Response(void 0, { headers: { allow: "GET, HEAD" }, status: 405 });
+      }
+      return Response.json({ ok: true }, { headers: { "cache-control": "no-store" } });
+    },
     [WS_PATH]: (request, env, url) => handleWebSocketUpgrade(request, env, url),
     [RPC_PATH]: (request, env, _url, context) => handleRpc(request, env, context),
+    [RPC_BATCH_PATH]: (request, env, _url, context) => handleBatchRpc(request, env, context),
     [SCHEDULER_DISPATCH_PATH]: (request, env) => handleSchedulerDispatch(request, env),
     [CRON_JOBS_RUN_PATH]: (request, env) => handleRunCronJob(request, env),
+    // Mint a short-lived HMAC-signed WS admin sub-token. Gated by the master
+    // admin bearer (header) / `adminGate`; the studio then sends the minted
+    // token — not the master credential — in the WS `?token=`
+    // query string. Signed with the master token itself, so both isolates
+    // verify statelessly and rotating `LUNORA_ADMIN_TOKEN` invalidates every
+    // outstanding sub-token. `no-store` keeps the token out of caches.
+    [ADMIN_WS_TOKEN_PATH]: async (request) => {
+      if (request.method !== "POST") {
+        throw new LunoraError("ws-token endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+      }
+      assertAdminAuthorized(request);
+      const signingSecret = effectiveAdminToken();
+      if (signingSecret === void 0) {
+        throw new LunoraError("ws-token minting requires a configured admin token", { code: "ADMIN_TOKEN_NOT_CONFIGURED", status: 400 });
+      }
+      const minted = await mintWsAdminToken(signingSecret);
+      return Response.json(minted, { headers: { "cache-control": "no-store" } });
+    },
     // Extracted handler clusters built above, merged in (mirroring the auth
     // plane below): orchestration (migrate / rank / rankpage / shard-traffic /
     // pitr), data-movement (export / import / sync / connector-sync / apply),
@@ -2394,13 +3207,13 @@ const createWorker = (options) => {
     ...workflowsAdminRoutes,
     ...storageAdminRoutes,
     ...vectorAdminRoutes,
+    ...kvAdminRoutes,
     ...introspectionAdminRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
     ...buildAuthAdminRoutes({
       assertAdmin: assertAdminAuthorized,
-      // eslint-disable-next-line sonarjs/deprecation -- `authIntrospector` is the intentional read-only fallback
-      getAuthAdmin: () => options.authAdmin ?? options.authIntrospector,
+      getAuthAdmin: () => options.authAdmin,
       parsePaging,
       queryParameter,
       readJsonBody: readJsonBodyWithLimit
@@ -2414,11 +3227,23 @@ const createWorker = (options) => {
       resolvedSecurity = resolveSecurity(options.security, env ?? {});
     }
   };
+  const applyAdminGate = async (request, pathname) => {
+    if (options.adminGate === void 0 || !isAdminPath(pathname)) {
+      return;
+    }
+    try {
+      if (await options.adminGate(request)) {
+        accessAdminGrants.add(request);
+      }
+    } catch {
+    }
+  };
   const handle = async (request, env, context) => {
     const url = new URL(request.url);
     if (request.method === "POST" || request.method === "PUT") {
       const contentLength = Number(request.headers.get("content-length") ?? "");
-      if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) {
+      const maxBodyBytes = url.pathname === KV_VALUE_PATH ? KV_VALUE_MAX_BODY_BYTES : MAX_BODY_BYTES;
+      if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
         throw new LunoraError("Body too large", { code: "PAYLOAD_TOO_LARGE", status: 413 });
       }
     }
@@ -2435,8 +3260,12 @@ const createWorker = (options) => {
     }
     const internalRoute = internalRoutes[url.pathname];
     if (internalRoute) {
+      await applyAdminGate(request, url.pathname);
       return internalRoute(request, env, url, context);
     }
+    if (options.voiceAgents !== void 0 && url.pathname.startsWith(VOICE_PATH_PREFIX)) {
+      return handleVoiceUpgrade(request, env, url);
+    }
     const httpRouteResponse = await dispatchHttpRoute(request, env, context);
     if (httpRouteResponse) {
       return httpRouteResponse;
@@ -2446,7 +3275,7 @@ const createWorker = (options) => {
   return {
     async fetch(request, env, context) {
       if (options.passThroughOnException) {
-        context.passThroughOnException();
+        context.passThroughOnException?.();
       }
       ensureSecurityResolved(env);
       resolveAdminTokenFromEnv(env);
@@ -2465,6 +3294,9 @@ const createWorker = (options) => {
         return decorateResponse(toErrorResponse(error), request, resolvedSecurity);
       }
     },
+    async queue(batch, env, context) {
+      await options.queue?.(batch, env, context);
+    },
     async scheduled(controller, env, context) {
       await handleScheduled(controller, env, context);
     },
@@ -2495,10 +3327,24 @@ const withFrameworkWorker = (host, optionsInput) => {
   const optionsFactory = optionsInput;
   return {
     fetch: (request, env, context) => build(optionsFactory(env)).fetch(request, env, context),
+    queue: (batch, env, context) => build(optionsFactory(env)).queue?.(batch, env, context) ?? Promise.resolve(),
     scheduled: (controller, env, context) => build(optionsFactory(env)).scheduled(controller, env, context),
     serverQuery: (request, env, reference, args, options) => build(optionsFactory(env)).serverQuery(request, env, reference, args, options)
   };
 };
+const resolveLunoraOptions = (options, env) => {
+  if (typeof options === "function") {
+    return options(env);
+  }
+  const shardDO = options.shardDO ?? env?.SHARD;
+  if (!shardDO) {
+    throw new LunoraError(
+      "@lunora/runtime: no shard Durable Object namespace found. Bind `SHARD` in wrangler.jsonc, or pass `createLunoraHandler({ shardDO: env.MY_SHARD })`."
+    );
+  }
+  return { ...options, shardDO };
+};
+const createLunoraHandler = (options = {}) => (request, env, context) => createWorker(resolveLunoraOptions(options, env)).fetch(request, env, context ?? NOOP_EXECUTION_CONTEXT);
 const defineRpcEnvelope = (envelope) => envelope;
 
-export { composeWorker, createWorker, defineRpcEnvelope, withFrameworkWorker };
+export { NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };