@lunora/runtime 1.0.0-alpha.34 → 1.0.0-alpha.35

package/dist/packem_shared/{composeWorker-DAwO9LLs.mjs → composeWorker-UwHY2r8O.mjs}

@@ -1,12 +1,16 @@
 import { isLunoraError, toErrorBody } from '@lunora/errors';
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-import { o as otlpRandomHex, b as buildTraceparent } from './otlp-DOLuy1Aj.mjs';
+import { o as otlpRandomHex, b as buildTraceparent } from './otlp-DKZJCkdD.mjs';
+import { r as resolveTraceSampling, a as emitRpcEvent } from './observability--NOFYBFc.mjs';
 import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
+import { runExportTap } from './createKvCursorStore-g8aA6B4L.mjs';
+import { m as methodGuard } from './method-guard-Qzw99aCj.mjs';
+import { buildHealthRoutes, durableObjectProbe, d1Probe, presenceProbe } from './HEALTH_PATH-e5J_NHBx.mjs';
 import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
 import { buildLogArchiveAdminRoutes } from './LOG_ARCHIVE_PATH-CNs0bznX.mjs';
-import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
+import { buildRestRoutes } from './argsFromQuery-BqPiQTPc.mjs';
 import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-DRWQFNhF.mjs';
 
 const evictOldestEntry = (map, capacity) => {
@@ -545,6 +549,52 @@ const buildAuthAdminRoutes = (deps) => {
   return routes;
 };
 
+const GET_AUTH_AUDIT_LOG_OP = "__lunora_admin__:getAuthAuditLog";
+const stringArgument = (value) => typeof value === "string" && value !== "" ? value : void 0;
+const numericArgument = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+const buildGetAuthAuditLog = (deps) => {
+  const handle = async (request, args) => {
+    deps.assertAdmin(request);
+    const reader = deps.getReader();
+    if (reader === void 0) {
+      throw new LunoraError("the auth/security audit endpoint requires an `authAuditReader` on the worker", {
+        code: "AUTH_AUDIT_NOT_CONFIGURED",
+        status: 400
+      });
+    }
+    const query = {};
+    const actorId = stringArgument(args["actorId"]);
+    const event = stringArgument(args["event"]);
+    const sinceSeq = numericArgument(args["sinceSeq"]);
+    const limit = numericArgument(args["limit"]);
+    if (actorId !== void 0) {
+      query.actorId = actorId;
+    }
+    if (event !== void 0) {
+      query.event = event;
+    }
+    if (sinceSeq !== void 0) {
+      query.sinceSeq = sinceSeq;
+    }
+    if (limit !== void 0) {
+      query.limit = limit;
+    }
+    let entries;
+    try {
+      entries = await reader.read(query);
+    } catch (error) {
+      if (error instanceof LunoraError) {
+        throw error;
+      }
+      console.error("[lunora] auth audit read failed:", error);
+      throw new LunoraError("auth audit read failed", { code: "AUTH_AUDIT_READ_FAILED", status: 500 });
+    }
+    const result = { entries };
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  return handle;
+};
+
 const MAX_BATCH_ENTRIES = 500;
 
 const normalizeBatchCall = (raw, index, defaultShard) => {
@@ -711,6 +761,7 @@ const IMPORT_PATH = "/_lunora/admin/import";
 const SYNC_PATH = "/_lunora/admin/sync";
 const CONNECTOR_SYNC_PATH = "/_lunora/admin/connector/sync";
 const APPLY_PATH = "/_lunora/admin/apply";
+const EXPORT_TAP_RUN_PATH = "/_lunora/admin/export-tap/run";
 const NDJSON_ENCODER$1 = new TextEncoder();
 const parseExportBody = async (request) => {
   let body;
@@ -740,18 +791,28 @@ const parseExportBody = async (request) => {
   return { tables };
 };
 const buildDataMovementAdminRoutes = (deps) => {
-  const { applyGlobals, isAdmin, knownTables, queryCoordinator, resolveForwardContext, shardDO, streamExportRows, streamingImport, syncGlobals } = deps;
+  const {
+    applyGlobals,
+    exportCursorStore,
+    exportSinks,
+    knownTables,
+    queryCoordinator,
+    requireAdminOption,
+    resolveForwardContext,
+    shardDO,
+    streamExportRows,
+    streamingImport,
+    syncGlobals
+  } = deps;
   const handleExport = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Export endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin export endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Export endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Export endpoint requires a `queryCoordinator` on the worker"
+    });
     const body = await parseExportBody(request);
     const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
     const stream = new ReadableStream({
@@ -771,16 +832,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return new Response(stream, { headers: { "content-type": "application/x-ndjson" }, status: 200 });
   };
   const handleCdcSync = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Sync endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const cursors = typeof raw["cursors"] === "object" && raw["cursors"] !== null ? raw["cursors"] : {};
     const limit = typeof raw["limit"] === "number" ? raw["limit"] : void 0;
@@ -798,16 +857,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json({ global, shards: shardResult.shards }, { status: 200 });
   };
   const handleConnectorSync = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Connector sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin connector sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Connector sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Connector sync endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const state = decodeConnectorCursor(raw["cursor"]);
     const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
@@ -838,16 +895,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json(page, { status: 200 });
   };
   const handleApplyCdc = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Apply endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin apply endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Apply endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Apply endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const rawBatches = Array.isArray(raw["batches"]) ? raw["batches"] : [];
     const batches = rawBatches.map((batch) => batch).filter(
@@ -865,15 +920,11 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json({ applied: shardResult.applied + globalApplied, failed: shardResult.failed, ok: shardResult.ok }, { status: 200 });
   };
   const handleImport = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Import endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin import endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    requireAdminOption(request, queryCoordinator, { code: "BAD_REQUEST", message: "Import endpoint requires a `queryCoordinator` on the worker" });
     const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
     const result = await streamingImport(request, forwardedHeaders);
     return Response.json(result, {
@@ -881,10 +932,50 @@ const buildDataMovementAdminRoutes = (deps) => {
       status: 200
     });
   };
+  const handleExportTapRun = async (request, env) => {
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
+    }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Export-tap endpoint requires a `queryCoordinator` on the worker"
+    });
+    if (exportSinks === void 0 || Object.keys(exportSinks).length === 0 || exportCursorStore === void 0) {
+      throw new LunoraError("Export-tap endpoint requires `exportSinks` + `exportCursorStore` on the worker", {
+        code: "EXPORT_TAP_NOT_CONFIGURED",
+        status: 400
+      });
+    }
+    const raw = await readJsonBodyWithLimit(request);
+    const sinkName = typeof raw["sink"] === "string" ? raw["sink"] : void 0;
+    const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
+    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
+    if (sinkName === void 0) {
+      throw new LunoraError("Export-tap `sink` must name a configured sink", { code: "BAD_REQUEST", status: 400 });
+    }
+    const sink = exportSinks[sinkName];
+    if (sink === void 0) {
+      throw new LunoraError(`Export-tap sink "${sinkName}" is not configured`, { code: "NOT_FOUND", status: 404 });
+    }
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const probeTables = requestedTables ?? knownTables();
+    const result = await runExportTap({
+      coordinator,
+      cursorStore: exportCursorStore,
+      headers: forwardedHeaders,
+      limit,
+      shardDO,
+      sink,
+      tables: probeTables
+    });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
   return {
     [APPLY_PATH]: handleApplyCdc,
     [CONNECTOR_SYNC_PATH]: handleConnectorSync,
     [EXPORT_PATH]: handleExport,
+    [EXPORT_TAP_RUN_PATH]: handleExportTapRun,
     [IMPORT_PATH]: handleImport,
     [SYNC_PATH]: handleCdcSync
   };
@@ -2009,6 +2100,7 @@ const readForwardedIdentity = (request) => {
 };
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
+const LIST_PUSH_SUBSCRIPTIONS_OP = "__lunora_admin__:listPushSubscriptions";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
 const isAuthAttemptPath = (pathname, basePath) => {
   const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
@@ -2276,6 +2368,25 @@ const checkAdminWsToken = async (request, expected, requireEphemeral) => {
   }
   return constantTimeEqual(expected, supplied);
 };
+const detectBindingProbe = (key, value) => {
+  if (value === null || typeof value !== "object" && typeof value !== "function") {
+    return void 0;
+  }
+  const shape = value;
+  if (typeof shape["prepare"] === "function" && typeof shape["batch"] === "function" && typeof shape["dump"] === "function") {
+    return d1Probe(`d1:${key}`, value);
+  }
+  if (typeof shape["list"] === "function" && typeof shape["head"] === "function" && typeof shape["createMultipartUpload"] === "function") {
+    return presenceProbe(`r2:${key}`, true);
+  }
+  if (typeof shape["send"] === "function" && typeof shape["sendBatch"] === "function" && typeof shape["get"] !== "function") {
+    return presenceProbe(`queue:${key}`, true);
+  }
+  if (typeof shape["connectionString"] === "string") {
+    return presenceProbe(`hyperdrive:${key}`, true);
+  }
+  return void 0;
+};
 const createWorker = (options) => {
   const defaultShard = options.defaultShardKey ?? "__root__";
   const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
@@ -2488,17 +2599,6 @@ const createWorker = (options) => {
     await releasePoolSlot(candidate);
     return response;
   };
-  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
-    applyGlobals: options.applyGlobals,
-    isAdmin: requestIsAdmin,
-    knownTables: () => collectKnownTables(),
-    queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: resolveAdminForwardContext,
-    shardDO,
-    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
-    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
-    syncGlobals: options.syncGlobals
-  });
   const assertAdminAuthorized = (request) => {
     if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
@@ -2511,6 +2611,49 @@ const createWorker = (options) => {
     }
     return value;
   };
+  const getAuthAuditLog = buildGetAuthAuditLog({
+    assertAdmin: assertAdminAuthorized,
+    getReader: () => options.authAuditReader
+  });
+  const listPushSubscriptions = async (request, args) => {
+    assertAdminAuthorized(request);
+    const store = options.notifySubscriptionStore;
+    if (store === void 0) {
+      return Response.json({ subscriptions: [] }, { headers: { "content-type": "application/json" }, status: 200 });
+    }
+    const rawKind = args?.["kind"];
+    const rawUserId = args?.["userId"];
+    const kindFilter = typeof rawKind === "string" && rawKind !== "" ? rawKind : void 0;
+    const userIdFilter = typeof rawUserId === "string" && rawUserId !== "" ? rawUserId : void 0;
+    const stored = await store.list();
+    const subscriptions = stored.filter((device) => (kindFilter === void 0 || device.kind === kindFilter) && (userIdFilter === void 0 || device.userId === userIdFilter)).map(({ keys: _keys, token: _token, ...device }) => device);
+    return Response.json({ subscriptions }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const serveReservedWorkerRpc = async (request, envelope) => {
+    if (envelope.fanOut) {
+      return void 0;
+    }
+    if (envelope.functionPath === GET_AUTH_AUDIT_LOG_OP) {
+      return getAuthAuditLog(request, envelope.args ?? {});
+    }
+    if (envelope.functionPath === LIST_PUSH_SUBSCRIPTIONS_OP) {
+      return listPushSubscriptions(request, envelope.args);
+    }
+    return void 0;
+  };
+  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
+    applyGlobals: options.applyGlobals,
+    exportCursorStore: options.exportCursorStore,
+    exportSinks: options.exportSinks,
+    knownTables: () => collectKnownTables(),
+    queryCoordinator: options.queryCoordinator,
+    requireAdminOption,
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO,
+    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
+    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
+    syncGlobals: options.syncGlobals
+  });
   const queryParameter = (url, name) => {
     const value = url.searchParams.get(name);
     return value === null || value === "" ? void 0 : value;
@@ -2588,6 +2731,32 @@ const createWorker = (options) => {
     queryParameter,
     requireAdminOption
   });
+  const resolveHealthProbes = (env) => {
+    const probes = [];
+    const namespace = shardDO ?? env?.SHARD;
+    if (namespace !== void 0) {
+      probes.push(durableObjectProbe("durable-object", namespace, defaultShard));
+    }
+    if (options.health?.disableBindingProbes !== true) {
+      for (const [key, value] of Object.entries(env ?? {})) {
+        const probe = detectBindingProbe(key, value);
+        if (probe !== void 0) {
+          probes.push(probe);
+        }
+      }
+    }
+    for (const probe of options.health?.probes ?? []) {
+      probes.push(probe);
+    }
+    return probes;
+  };
+  const healthRoutes = buildHealthRoutes({
+    appName: options.health?.appName,
+    appVersion: options.health?.appVersion,
+    auth: options.health?.auth ?? "public",
+    isAdmin: requestIsAdmin,
+    resolveProbes: resolveHealthProbes
+  });
   const buildHttpActionContext = async (request, env, context) => {
     const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
     const run = async (reference, args = {}) => {
@@ -2777,12 +2946,17 @@ const createWorker = (options) => {
   };
   const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
     const rpcStartedAt = Date.now();
-    const { observability } = options;
+    const { observability, sampling } = options;
     const traceId = otlpRandomHex(16);
     const spanId = otlpRandomHex(8);
+    const decision = resolveTraceSampling(sampling, traceId);
     const forwarded = new Request(`https://shard.internal/rpc`, {
       body: JSON.stringify({ args, functionPath }),
-      headers: { ...forwardedHeaders, traceparent: buildTraceparent(traceId, spanId) },
+      headers: {
+        ...forwardedHeaders,
+        traceparent: buildTraceparent(traceId, spanId, decision.isTraced),
+        "x-lunora-sample-errors": decision.keepErrors ? "1" : "0"
+      },
       method: "POST"
     });
     try {
@@ -2798,20 +2972,21 @@ const createWorker = (options) => {
           traceId,
           ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
         },
-        sinkContext
+        sinkContext,
+        sampling
       );
       return response;
     } catch (error) {
-      emitRpcEvent(observability, { ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), spanId, traceId }, sinkContext);
+      emitRpcEvent(
+        observability,
+        { ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), spanId, traceId },
+        sinkContext,
+        sampling
+      );
       throw error;
     }
   };
-  const handleRpc = async (request, env, context) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const envelope = await parseEnvelope(request);
-    logRpcDebug(env, envelope);
+  const assertDispatchableEnvelope = (envelope) => {
     if (envelope.fanOut && envelope.shardKey) {
       throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
     }
@@ -2827,6 +3002,18 @@ const createWorker = (options) => {
         status: 400
       });
     }
+  };
+  const handleRpc = async (request, env, context) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const envelope = await parseEnvelope(request);
+    logRpcDebug(env, envelope);
+    assertDispatchableEnvelope(envelope);
+    const reservedResponse = await serveReservedWorkerRpc(request, envelope);
+    if (reservedResponse !== void 0) {
+      return reservedResponse;
+    }
     const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
     const x402Tag = resolveX402Charge(envelope, options);
@@ -3171,6 +3358,24 @@ const createWorker = (options) => {
     }
     return authResponse;
   };
+  const invokeExposed = async ({ args, env, functionPath, request, shardKey }) => {
+    const envelope = { functionPath, ...shardKey === void 0 ? {} : { shardKey } };
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
+    await authorizeRpcEnvelope(envelope, identity);
+    const resolvedShardKey = shardKey ?? defaultShard;
+    const dispatch = () => dispatchSingleShard(functionPath, args, resolvedShardKey, forwardedHeaders);
+    const x402Tag = resolveX402Charge(envelope, options);
+    if (x402Tag && options.x402Charge) {
+      return options.x402Charge(request, { functionPath, price: x402Tag.price }, dispatch);
+    }
+    return dispatch();
+  };
+  const restRoutes = buildRestRoutes({
+    functions: options.functions ?? {},
+    invoke: invokeExposed,
+    readJsonBody: readJsonBodyWithLimit,
+    ...options.restRateLimit ? { rateLimit: options.restRateLimit } : {}
+  });
   const customRoutes = options.routes !== void 0 && Object.keys(options.routes).length > 0 ? options.routes : void 0;
   const internalRoutes = {
     [STATUS_PATH]: (request) => {
@@ -3216,6 +3421,14 @@ const createWorker = (options) => {
     ...kvAdminRoutes,
     ...logArchiveAdminRoutes,
     ...introspectionAdminRoutes,
+    // `/_lunora/health` + `/_lunora/health/ready` — public (or admin-gated)
+    // liveness/readiness probes; not under the admin prefix, so `applyAdminGate`
+    // never runs on them (the handler self-gates when `auth: "admin"`).
+    ...healthRoutes,
+    // `/_lunora/rest/<namespace>/<fn>` — the opt-in public REST surface, one
+    // route per `.expose({ rest: true })` procedure (default-closed). Routes
+    // THROUGH the procedure, so auth/RLS/validators are enforced at the shard.
+    ...restRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
     ...buildAuthAdminRoutes({
@@ -3354,4 +3567,4 @@ const resolveLunoraOptions = (options, env) => {
 const createLunoraHandler = (options = {}) => (request, env, context) => createWorker(resolveLunoraOptions(options, env)).fetch(request, env, context ?? NOOP_EXECUTION_CONTEXT);
 const defineRpcEnvelope = (envelope) => envelope;
 
-export { NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };
+export { GET_AUTH_AUDIT_LOG_OP, NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };

package/dist/packem_shared/createKvCursorStore-g8aA6B4L.mjs

@@ -0,0 +1,165 @@
+const defaultSleep = (ms) => new Promise((resolve) => {
+  setTimeout(resolve, ms);
+});
+const sanitizeChange = (raw) => {
+  const table = typeof raw["table"] === "string" ? raw["table"] : "";
+  const rawOp = typeof raw["op"] === "string" ? raw["op"] : "";
+  const op = rawOp === "delete" || rawOp === "insert" || rawOp === "update" ? rawOp : "upsert";
+  const id = typeof raw["id"] === "string" ? raw["id"] : void 0;
+  const documentRow = raw["doc"] && typeof raw["doc"] === "object" ? raw["doc"] : void 0;
+  const seq = typeof raw["seq"] === "number" && Number.isFinite(raw["seq"]) ? raw["seq"] : void 0;
+  const ts = typeof raw["ts"] === "number" && Number.isFinite(raw["ts"]) ? raw["ts"] : void 0;
+  return {
+    op,
+    table,
+    ...documentRow === void 0 ? {} : { doc: documentRow },
+    ...id === void 0 ? {} : { id },
+    ...seq === void 0 ? {} : { seq },
+    ...ts === void 0 ? {} : { ts }
+  };
+};
+const deliverWithRetry = async (sink, batch, maxRetries, initialBackoffMs, maxBackoffMs, sleep) => {
+  let attempt = 0;
+  while (true) {
+    try {
+      await sink.deliver(batch);
+      return;
+    } catch (error) {
+      if (attempt >= maxRetries) {
+        throw error instanceof Error ? error : new Error(String(error));
+      }
+      const delay = Math.min(initialBackoffMs * 2 ** attempt, maxBackoffMs);
+      await sleep(delay);
+      attempt += 1;
+    }
+  }
+};
+const runExportTap = async (options) => {
+  const {
+    coordinator,
+    cursorStore,
+    headers,
+    initialBackoffMs = 100,
+    limit,
+    maxBackoffMs = 5e3,
+    maxRetries = 3,
+    shardDO,
+    sink,
+    sleep = defaultSleep,
+    tables
+  } = options;
+  const priorCursors = await cursorStore.read(sink.name);
+  const feed = await coordinator.orchestrateCdcSync(shardDO, { cursors: priorCursors, headers, limit, tables });
+  const nextCursors = { ...priorCursors };
+  const failures = [];
+  let delivered = 0;
+  let hasMore = false;
+  for (const shard of feed.shards) {
+    if (shard.error) {
+      failures.push({ error: shard.error.message, shardKey: shard.shardKey });
+      hasMore = true;
+      continue;
+    }
+    const rawChanges = shard.changes ?? [];
+    if (rawChanges.length === 0) {
+      nextCursors[shard.shardKey] = shard.cursor;
+      continue;
+    }
+    const changes = rawChanges.map((change) => sanitizeChange(change));
+    const batch = { changes, cursor: shard.cursor, shardKey: shard.shardKey, sink: sink.name };
+    try {
+      await deliverWithRetry(sink, batch, maxRetries, initialBackoffMs, maxBackoffMs, sleep);
+      nextCursors[shard.shardKey] = shard.cursor;
+      delivered += changes.length;
+      if (limit !== void 0 && rawChanges.length >= limit) {
+        hasMore = true;
+      }
+    } catch (error) {
+      failures.push({ error: error instanceof Error ? error.message : String(error), shardKey: shard.shardKey });
+      hasMore = true;
+    }
+  }
+  await cursorStore.write(sink.name, nextCursors);
+  return { cursors: nextCursors, delivered, failures, hasMore, shards: feed.shards.length };
+};
+const defineExportSink = (config) => {
+  if (typeof config.name !== "string" || config.name.length === 0) {
+    throw new Error("defineExportSink: `name` must be a non-empty string");
+  }
+  if (typeof config.deliver !== "function") {
+    throw new TypeError("defineExportSink: `deliver` must be a function");
+  }
+  return { deliver: config.deliver, name: config.name };
+};
+const encodeNdjson = (changes) => `${changes.map((change) => JSON.stringify(change)).join("\n")}
+`;
+const webhookExportSink = (config) => {
+  const fetchImpl = config.fetchImpl ?? ((input, init) => fetch(input, init));
+  return defineExportSink({
+    deliver: async (batch) => {
+      const response = await fetchImpl(config.url, {
+        body: encodeNdjson(batch.changes),
+        headers: {
+          "content-type": "application/x-ndjson",
+          "x-lunora-cursor": String(batch.cursor),
+          "x-lunora-shard": batch.shardKey,
+          "x-lunora-sink": batch.sink,
+          ...config.headers
+        },
+        method: "POST"
+      });
+      if (!response.ok) {
+        throw new Error(`webhook export sink "${config.name}" returned ${String(response.status)}`);
+      }
+    },
+    name: config.name
+  });
+};
+const r2Sink = (config) => {
+  let prefix = config.prefix ?? "cdc";
+  while (prefix.endsWith("/")) {
+    prefix = prefix.slice(0, -1);
+  }
+  return defineExportSink({
+    deliver: async (batch) => {
+      const key = `${prefix}/${batch.shardKey}/${String(batch.cursor)}.ndjson`;
+      await config.bucket.put(key, encodeNdjson(batch.changes), { httpMetadata: { contentType: "application/x-ndjson" } });
+    },
+    name: config.name
+  });
+};
+const createMemoryCursorStore = () => {
+  const state = {};
+  return {
+    read: (sink) => Promise.resolve({ ...state[sink] }),
+    snapshot: () => structuredClone(state),
+    write: (sink, cursors) => {
+      state[sink] = { ...cursors };
+      return Promise.resolve();
+    }
+  };
+};
+const createKvCursorStore = (kv, options) => {
+  const keyPrefix = options?.keyPrefix ?? "__lunora_source_cursor:export";
+  const keyFor = (sink) => `${keyPrefix}:${sink}`;
+  return {
+    read: async (sink) => {
+      const raw = await kv.get(keyFor(sink), "json");
+      if (raw === null || typeof raw !== "object") {
+        return {};
+      }
+      const cursors = {};
+      for (const [shardKey, value] of Object.entries(raw)) {
+        if (typeof value === "number" && Number.isFinite(value)) {
+          cursors[shardKey] = value;
+        }
+      }
+      return cursors;
+    },
+    write: async (sink, cursors) => {
+      await kv.put(keyFor(sink), JSON.stringify(cursors));
+    }
+  };
+};
+
+export { createKvCursorStore, createMemoryCursorStore, defineExportSink, r2Sink, runExportTap, sanitizeChange, webhookExportSink };

package/dist/packem_shared/emitLogEvent-BlGMnKZK.mjs

@@ -0,0 +1 @@
+export { e as emitLogEvent, a as emitRpcEvent } from './observability--NOFYBFc.mjs';

package/dist/packem_shared/method-guard-Qzw99aCj.mjs

@@ -0,0 +1,3 @@
+const methodGuard = (request, allowed) => allowed.includes(request.method) ? void 0 : new Response(void 0, { headers: { allow: allowed.join(", ") }, status: 405 });
+
+export { methodGuard as m };