@lunora/runtime 1.0.0-alpha.34 → 1.0.0-alpha.36

package/dist/packem_shared/{composeWorker-DAwO9LLs.mjs → composeWorker-DiWwOXXt.mjs}

@@ -1,12 +1,16 @@
 import { isLunoraError, toErrorBody } from '@lunora/errors';
 import { NOOP_EXECUTION_CONTEXT } from './NOOP_EXECUTION_CONTEXT-CCTu0Bf1.mjs';
-import { o as otlpRandomHex, b as buildTraceparent } from './otlp-DOLuy1Aj.mjs';
 import { LunoraError, toErrorResponse } from './LunoraError-Bpb9EFJ3.mjs';
+import { runExportTap } from './createKvCursorStore-g8aA6B4L.mjs';
+import { m as methodGuard } from './method-guard-Qzw99aCj.mjs';
+import { buildHealthRoutes, durableObjectProbe, d1Probe, presenceProbe } from './HEALTH_PATH-e5J_NHBx.mjs';
 import { wrapResolverWithContract } from './composeIdentityResolvers-XGjO7V1J.mjs';
 export { composeIdentityResolvers, routeIdentityResolvers } from './composeIdentityResolvers-XGjO7V1J.mjs';
 import { buildLogArchiveAdminRoutes } from './LOG_ARCHIVE_PATH-CNs0bznX.mjs';
-import { emitRpcEvent } from './emitLogEvent-pEdtqAK8.mjs';
+import { r as resolveTraceSampling, a as emitRpcEvent } from './observability--NOFYBFc.mjs';
+import { o as otlpRandomHex, b as buildTraceparent, p as parseTraceparent, m as mergeResourceAttributes, d as detectCloudflareResource, a as detectServiceResource, r as readerFromRecord } from './otlp-resource-Dow6-F_u.mjs';
 import { resolveShard, applyJurisdiction } from './applyJurisdiction-BkZtTkct.mjs';
+import { buildRestRoutes } from './argsFromQuery-c-U1WRy-.mjs';
 import { resolveSecurity, handleCorsPreflight, enforceOrigin, decorateResponse, enforceWebSocketOrigin } from './decorateResponse-DRWQFNhF.mjs';
 
 const evictOldestEntry = (map, capacity) => {
@@ -545,6 +549,52 @@ const buildAuthAdminRoutes = (deps) => {
   return routes;
 };
 
+const GET_AUTH_AUDIT_LOG_OP = "__lunora_admin__:getAuthAuditLog";
+const stringArgument = (value) => typeof value === "string" && value !== "" ? value : void 0;
+const numericArgument = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
+const buildGetAuthAuditLog = (deps) => {
+  const handle = async (request, args) => {
+    deps.assertAdmin(request);
+    const reader = deps.getReader();
+    if (reader === void 0) {
+      throw new LunoraError("the auth/security audit endpoint requires an `authAuditReader` on the worker", {
+        code: "AUTH_AUDIT_NOT_CONFIGURED",
+        status: 400
+      });
+    }
+    const query = {};
+    const actorId = stringArgument(args["actorId"]);
+    const event = stringArgument(args["event"]);
+    const sinceSeq = numericArgument(args["sinceSeq"]);
+    const limit = numericArgument(args["limit"]);
+    if (actorId !== void 0) {
+      query.actorId = actorId;
+    }
+    if (event !== void 0) {
+      query.event = event;
+    }
+    if (sinceSeq !== void 0) {
+      query.sinceSeq = sinceSeq;
+    }
+    if (limit !== void 0) {
+      query.limit = limit;
+    }
+    let entries;
+    try {
+      entries = await reader.read(query);
+    } catch (error) {
+      if (error instanceof LunoraError) {
+        throw error;
+      }
+      console.error("[lunora] auth audit read failed:", error);
+      throw new LunoraError("auth audit read failed", { code: "AUTH_AUDIT_READ_FAILED", status: 500 });
+    }
+    const result = { entries };
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  return handle;
+};
+
 const MAX_BATCH_ENTRIES = 500;
 
 const normalizeBatchCall = (raw, index, defaultShard) => {
@@ -711,6 +761,7 @@ const IMPORT_PATH = "/_lunora/admin/import";
 const SYNC_PATH = "/_lunora/admin/sync";
 const CONNECTOR_SYNC_PATH = "/_lunora/admin/connector/sync";
 const APPLY_PATH = "/_lunora/admin/apply";
+const EXPORT_TAP_RUN_PATH = "/_lunora/admin/export-tap/run";
 const NDJSON_ENCODER$1 = new TextEncoder();
 const parseExportBody = async (request) => {
   let body;
@@ -740,18 +791,28 @@ const parseExportBody = async (request) => {
   return { tables };
 };
 const buildDataMovementAdminRoutes = (deps) => {
-  const { applyGlobals, isAdmin, knownTables, queryCoordinator, resolveForwardContext, shardDO, streamExportRows, streamingImport, syncGlobals } = deps;
+  const {
+    applyGlobals,
+    exportCursorStore,
+    exportSinks,
+    knownTables,
+    queryCoordinator,
+    requireAdminOption,
+    resolveForwardContext,
+    shardDO,
+    streamExportRows,
+    streamingImport,
+    syncGlobals
+  } = deps;
   const handleExport = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Export endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin export endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Export endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Export endpoint requires a `queryCoordinator` on the worker"
+    });
     const body = await parseExportBody(request);
     const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
     const stream = new ReadableStream({
@@ -771,16 +832,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return new Response(stream, { headers: { "content-type": "application/x-ndjson" }, status: 200 });
   };
   const handleCdcSync = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Sync endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const cursors = typeof raw["cursors"] === "object" && raw["cursors"] !== null ? raw["cursors"] : {};
     const limit = typeof raw["limit"] === "number" ? raw["limit"] : void 0;
@@ -798,16 +857,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json({ global, shards: shardResult.shards }, { status: 200 });
   };
   const handleConnectorSync = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Connector sync endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin connector sync endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Connector sync endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Connector sync endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const state = decodeConnectorCursor(raw["cursor"]);
     const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
@@ -838,16 +895,14 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json(page, { status: 200 });
   };
   const handleApplyCdc = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Apply endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin apply endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    const coordinator = queryCoordinator;
-    if (!coordinator) {
-      throw new LunoraError("Apply endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Apply endpoint requires a `queryCoordinator` on the worker"
+    });
     const raw = await readJsonBodyWithLimit(request);
     const rawBatches = Array.isArray(raw["batches"]) ? raw["batches"] : [];
     const batches = rawBatches.map((batch) => batch).filter(
@@ -865,15 +920,11 @@ const buildDataMovementAdminRoutes = (deps) => {
     return Response.json({ applied: shardResult.applied + globalApplied, failed: shardResult.failed, ok: shardResult.ok }, { status: 200 });
   };
   const handleImport = async (request, env) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("Import endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    if (!isAdmin(request)) {
-      throw new LunoraError("admin import endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
-    }
-    if (!queryCoordinator) {
-      throw new LunoraError("Import endpoint requires a `queryCoordinator` on the worker", { code: "BAD_REQUEST", status: 400 });
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
     }
+    requireAdminOption(request, queryCoordinator, { code: "BAD_REQUEST", message: "Import endpoint requires a `queryCoordinator` on the worker" });
     const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
     const result = await streamingImport(request, forwardedHeaders);
     return Response.json(result, {
@@ -881,10 +932,50 @@ const buildDataMovementAdminRoutes = (deps) => {
       status: 200
     });
   };
+  const handleExportTapRun = async (request, env) => {
+    const wrongMethod = methodGuard(request, ["POST"]);
+    if (wrongMethod) {
+      return wrongMethod;
+    }
+    const coordinator = requireAdminOption(request, queryCoordinator, {
+      code: "BAD_REQUEST",
+      message: "Export-tap endpoint requires a `queryCoordinator` on the worker"
+    });
+    if (exportSinks === void 0 || Object.keys(exportSinks).length === 0 || exportCursorStore === void 0) {
+      throw new LunoraError("Export-tap endpoint requires `exportSinks` + `exportCursorStore` on the worker", {
+        code: "EXPORT_TAP_NOT_CONFIGURED",
+        status: 400
+      });
+    }
+    const raw = await readJsonBodyWithLimit(request);
+    const sinkName = typeof raw["sink"] === "string" ? raw["sink"] : void 0;
+    const limit = typeof raw["limit"] === "number" && raw["limit"] > 0 ? raw["limit"] : void 0;
+    const requestedTables = Array.isArray(raw["tables"]) ? raw["tables"].filter((table) => typeof table === "string") : void 0;
+    if (sinkName === void 0) {
+      throw new LunoraError("Export-tap `sink` must name a configured sink", { code: "BAD_REQUEST", status: 400 });
+    }
+    const sink = exportSinks[sinkName];
+    if (sink === void 0) {
+      throw new LunoraError(`Export-tap sink "${sinkName}" is not configured`, { code: "NOT_FOUND", status: 404 });
+    }
+    const { headers: forwardedHeaders } = await resolveForwardContext(request, env);
+    const probeTables = requestedTables ?? knownTables();
+    const result = await runExportTap({
+      coordinator,
+      cursorStore: exportCursorStore,
+      headers: forwardedHeaders,
+      limit,
+      shardDO,
+      sink,
+      tables: probeTables
+    });
+    return Response.json(result, { headers: { "content-type": "application/json" }, status: 200 });
+  };
   return {
     [APPLY_PATH]: handleApplyCdc,
     [CONNECTOR_SYNC_PATH]: handleConnectorSync,
     [EXPORT_PATH]: handleExport,
+    [EXPORT_TAP_RUN_PATH]: handleExportTapRun,
     [IMPORT_PATH]: handleImport,
     [SYNC_PATH]: handleCdcSync
   };
@@ -1662,6 +1753,83 @@ const buildOrchestrationAdminRoutes = (deps) => {
   };
 };
 
+const SAMPLED_FLAG = 1;
+const UNSAMPLED_FLAG = 0;
+const MAX_TRACE_STATE_MEMBERS = 32;
+const MAX_TRACE_STATE_LENGTH = 512;
+const TRACE_STATE_MEMBER = /^[a-z][\d_a-z*/-]{0,255}(?:@[a-z][\d_a-z*/-]{0,13})?=[\u0020-\u002B\u002D-\u003C\u003E-\u007E]{1,256}$/;
+const sanitizeTraceState = (header) => {
+  if (header === null || header === void 0) {
+    return void 0;
+  }
+  const trimmed = header.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_TRACE_STATE_LENGTH) {
+    return void 0;
+  }
+  const members = trimmed.split(",");
+  if (members.length > MAX_TRACE_STATE_MEMBERS) {
+    return void 0;
+  }
+  for (const member of members) {
+    if (!TRACE_STATE_MEMBER.test(member.trim())) {
+      return void 0;
+    }
+  }
+  return trimmed;
+};
+const extractTraceContext = (request) => {
+  const parsed = parseTraceparent(request.headers.get("traceparent"));
+  if (parsed === void 0) {
+    return void 0;
+  }
+  const traceState = sanitizeTraceState(request.headers.get("tracestate"));
+  return {
+    parentSpanId: parsed.parentSpanId,
+    sampled: parsed.sampled,
+    traceId: parsed.traceId,
+    ...traceState === void 0 ? {} : { traceState }
+  };
+};
+const beginDispatchTrace = (request, options = {}) => {
+  const upstream = extractTraceContext(request);
+  const trusted = options.trustInbound === true ? upstream : void 0;
+  const spanId = otlpRandomHex(8);
+  const traceId = trusted?.traceId ?? otlpRandomHex(16);
+  const decision = resolveTraceSampling(options.sampling, trusted === void 0 ? spanId : traceId);
+  const sampled = decision.isTraced && (trusted === void 0 || trusted.sampled);
+  return {
+    decision,
+    // A parseable upstream trace existed, and we chose not to join it.
+    ignoredUpstream: upstream !== void 0 && trusted === void 0,
+    trace: {
+      sampled,
+      spanId,
+      traceFlags: sampled ? SAMPLED_FLAG : UNSAMPLED_FLAG,
+      traceId,
+      ...trusted?.parentSpanId === void 0 ? {} : { parentSpanId: trusted.parentSpanId },
+      ...trusted?.traceState === void 0 ? {} : { traceState: trusted.traceState }
+    }
+  };
+};
+const injectTraceContext = (trace, headers) => {
+  headers.traceparent = buildTraceparent(trace.traceId, trace.spanId, trace.sampled);
+  if (trace.traceState !== void 0) {
+    headers.tracestate = trace.traceState;
+  }
+};
+
+const createResourceAttributeResolver = (environment, request) => {
+  let resolved;
+  return () => {
+    if (resolved === void 0) {
+      const read = readerFromRecord(environment);
+      const cf = request === void 0 ? void 0 : request.cf;
+      resolved = mergeResourceAttributes(detectServiceResource(read), detectCloudflareResource(read, cf));
+    }
+    return resolved;
+  };
+};
+
 const SCHEDULED_PATH = "/_lunora/admin/scheduled";
 const SCHEDULED_STATUS_PATH = "/_lunora/admin/scheduled/status";
 const SCHEDULED_WS_PATH = "/_lunora/admin/scheduled/ws";
@@ -1843,6 +2011,51 @@ const buildStorageAdminRoutes = (deps) => {
   };
 };
 
+const cfString = (request, ...path) => {
+  let current = request.cf;
+  for (const key of path) {
+    if (typeof current !== "object" || current === null) {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return typeof current === "string" ? current : void 0;
+};
+const SIGNAL_CHECKS = {
+  // Edge-verified client certificate — the platform sets `certVerified`, so
+  // unlike a header this cannot be spoofed by the caller.
+  mtls: (request) => cfString(request, "tlsClientAuth", "certVerified") === "SUCCESS"
+};
+const resolveTraceTrust = (option) => {
+  if (option === void 0 || option === false) {
+    return () => false;
+  }
+  if (option === true) {
+    return () => true;
+  }
+  if (typeof option === "function") {
+    return option;
+  }
+  const check = Object.entries(SIGNAL_CHECKS).find(([signal]) => signal === option)?.[1];
+  return check ?? (() => false);
+};
+const createDroppedTraceNotice = (option) => {
+  if (option !== void 0) {
+    return () => {
+    };
+  }
+  let notified = false;
+  return () => {
+    if (notified) {
+      return;
+    }
+    notified = true;
+    console.warn(
+      '[lunora] Ignored an inbound `traceparent`, so this request starts a new trace instead of joining the caller\'s. That is the safe default: the header is caller-supplied, and trusting it lets any client choose which trace its spans and logs join. If this worker sits behind a gateway, service mesh, or Cloudflare Access that sets `traceparent` itself, set `trustInboundTraceContext: true` on createWorker() (or `"mtls"` to trust only edge-verified client certificates). Set it to `false` to keep this behaviour and silence this message.'
+    );
+  };
+};
+
 const VECTOR_INDEXES_PATH = "/_lunora/admin/vector/indexes";
 const VECTOR_QUERY_PATH = "/_lunora/admin/vector/query";
 const buildVectorAdminRoutes = (deps) => {
@@ -1987,6 +2200,39 @@ const NDJSON_ENCODER = new TextEncoder();
 const RPC_PATH = "/_lunora/rpc";
 const RPC_BATCH_PATH = "/_lunora/rpc-batch";
 const WS_PATH = "/_lunora/ws";
+const buildSinkContext = (environment, request, waitUntil) => {
+  return {
+    resourceAttributes: createResourceAttributeResolver(environment, request),
+    ...waitUntil === void 0 ? {} : { waitUntil }
+  };
+};
+const traceEventFields = (trace) => {
+  return {
+    spanId: trace.spanId,
+    traceFlags: trace.traceFlags,
+    traceId: trace.traceId,
+    ...trace.parentSpanId === void 0 ? {} : { parentSpanId: trace.parentSpanId }
+  };
+};
+const requestTelemetryMeta = (request) => {
+  const { method } = request;
+  const userAgent = request.headers.get("user-agent") ?? void 0;
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return { method, userAgent };
+  }
+  const port = url.port === "" ? void 0 : Number(url.port);
+  return {
+    host: url.hostname,
+    method,
+    path: url.pathname,
+    port: Number.isNaN(port) ? void 0 : port,
+    scheme: url.protocol.replace(":", ""),
+    userAgent
+  };
+};
 const VOICE_PATH_PREFIX = "/_lunora/voice/";
 const SCHEDULER_DISPATCH_PATH = "/_lunora/scheduler/dispatch";
 const CRON_JOBS_RUN_PATH = "/_lunora/admin/cron-jobs/run";
@@ -2009,6 +2255,7 @@ const readForwardedIdentity = (request) => {
 };
 const DEFAULT_AUTH_BASE_PATH = "/api/auth";
 const RECORD_AUTH_EVENT_OP = "__lunora_admin__:recordAuthEvent";
+const LIST_PUSH_SUBSCRIPTIONS_OP = "__lunora_admin__:listPushSubscriptions";
 const AUTH_ATTEMPT_SEGMENTS = ["/sign-in", "/sign-up", "/callback"];
 const isAuthAttemptPath = (pathname, basePath) => {
   const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
@@ -2276,7 +2523,28 @@ const checkAdminWsToken = async (request, expected, requireEphemeral) => {
   }
   return constantTimeEqual(expected, supplied);
 };
+const detectBindingProbe = (key, value) => {
+  if (value === null || typeof value !== "object" && typeof value !== "function") {
+    return void 0;
+  }
+  const shape = value;
+  if (typeof shape["prepare"] === "function" && typeof shape["batch"] === "function" && typeof shape["dump"] === "function") {
+    return d1Probe(`d1:${key}`, value);
+  }
+  if (typeof shape["list"] === "function" && typeof shape["head"] === "function" && typeof shape["createMultipartUpload"] === "function") {
+    return presenceProbe(`r2:${key}`, true);
+  }
+  if (typeof shape["send"] === "function" && typeof shape["sendBatch"] === "function" && typeof shape["get"] !== "function") {
+    return presenceProbe(`queue:${key}`, true);
+  }
+  if (typeof shape["connectionString"] === "string") {
+    return presenceProbe(`hyperdrive:${key}`, true);
+  }
+  return void 0;
+};
 const createWorker = (options) => {
+  const isTrustedUpstream = resolveTraceTrust(options.trustInboundTraceContext);
+  const noticeDroppedTrace = createDroppedTraceNotice(options.trustInboundTraceContext);
   const defaultShard = options.defaultShardKey ?? "__root__";
   const publicResolveIdentity = wrapResolverWithContract(options.resolveIdentity, options.identity);
   const shardDO = applyJurisdiction(options.shardDO, options.jurisdiction);
@@ -2488,17 +2756,6 @@ const createWorker = (options) => {
     await releasePoolSlot(candidate);
     return response;
   };
-  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
-    applyGlobals: options.applyGlobals,
-    isAdmin: requestIsAdmin,
-    knownTables: () => collectKnownTables(),
-    queryCoordinator: options.queryCoordinator,
-    resolveForwardContext: resolveAdminForwardContext,
-    shardDO,
-    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
-    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
-    syncGlobals: options.syncGlobals
-  });
   const assertAdminAuthorized = (request) => {
     if (!requestIsAdmin(request)) {
       throw new LunoraError("admin endpoint requires a valid admin bearer", { code: "ADMIN_FORBIDDEN", status: 403 });
@@ -2511,6 +2768,49 @@ const createWorker = (options) => {
     }
     return value;
   };
+  const getAuthAuditLog = buildGetAuthAuditLog({
+    assertAdmin: assertAdminAuthorized,
+    getReader: () => options.authAuditReader
+  });
+  const listPushSubscriptions = async (request, args) => {
+    assertAdminAuthorized(request);
+    const store = options.notifySubscriptionStore;
+    if (store === void 0) {
+      return Response.json({ subscriptions: [] }, { headers: { "content-type": "application/json" }, status: 200 });
+    }
+    const rawKind = args?.["kind"];
+    const rawUserId = args?.["userId"];
+    const kindFilter = typeof rawKind === "string" && rawKind !== "" ? rawKind : void 0;
+    const userIdFilter = typeof rawUserId === "string" && rawUserId !== "" ? rawUserId : void 0;
+    const stored = await store.list();
+    const subscriptions = stored.filter((device) => (kindFilter === void 0 || device.kind === kindFilter) && (userIdFilter === void 0 || device.userId === userIdFilter)).map(({ keys: _keys, token: _token, ...device }) => device);
+    return Response.json({ subscriptions }, { headers: { "content-type": "application/json" }, status: 200 });
+  };
+  const serveReservedWorkerRpc = async (request, envelope) => {
+    if (envelope.fanOut) {
+      return void 0;
+    }
+    if (envelope.functionPath === GET_AUTH_AUDIT_LOG_OP) {
+      return getAuthAuditLog(request, envelope.args ?? {});
+    }
+    if (envelope.functionPath === LIST_PUSH_SUBSCRIPTIONS_OP) {
+      return listPushSubscriptions(request, envelope.args);
+    }
+    return void 0;
+  };
+  const dataMovementAdminRoutes = buildDataMovementAdminRoutes({
+    applyGlobals: options.applyGlobals,
+    exportCursorStore: options.exportCursorStore,
+    exportSinks: options.exportSinks,
+    knownTables: () => collectKnownTables(),
+    queryCoordinator: options.queryCoordinator,
+    requireAdminOption,
+    resolveForwardContext: resolveAdminForwardContext,
+    shardDO,
+    streamExportRows: (coordinator, headers, tables, writeRow) => streamExportRows(options, coordinator, headers, tables, writeRow, shardDO),
+    streamingImport: (request, headers) => streamingImport(request, options, headers, shardDO),
+    syncGlobals: options.syncGlobals
+  });
   const queryParameter = (url, name) => {
     const value = url.searchParams.get(name);
     return value === null || value === "" ? void 0 : value;
@@ -2588,6 +2888,32 @@ const createWorker = (options) => {
     queryParameter,
     requireAdminOption
   });
+  const resolveHealthProbes = (env) => {
+    const probes = [];
+    const namespace = shardDO ?? env?.SHARD;
+    if (namespace !== void 0) {
+      probes.push(durableObjectProbe("durable-object", namespace, defaultShard));
+    }
+    if (options.health?.disableBindingProbes !== true) {
+      for (const [key, value] of Object.entries(env ?? {})) {
+        const probe = detectBindingProbe(key, value);
+        if (probe !== void 0) {
+          probes.push(probe);
+        }
+      }
+    }
+    for (const probe of options.health?.probes ?? []) {
+      probes.push(probe);
+    }
+    return probes;
+  };
+  const healthRoutes = buildHealthRoutes({
+    appName: options.health?.appName,
+    appVersion: options.health?.appVersion,
+    auth: options.health?.auth ?? "public",
+    isAdmin: requestIsAdmin,
+    resolveProbes: resolveHealthProbes
+  });
   const buildHttpActionContext = async (request, env, context) => {
     const { claims, headers, userId } = await resolveForwardContext(request, env, publicResolveIdentity);
     const run = async (reference, args = {}) => {
@@ -2775,14 +3101,25 @@ const createWorker = (options) => {
       guardUnauthenticatedShardAccess("shard");
     }
   };
-  const dispatchSingleShard = async (functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
+  const dispatchSingleShard = async (request, functionPath, args, shardKey, forwardedHeaders, sinkContext) => {
     const rpcStartedAt = Date.now();
-    const { observability } = options;
-    const traceId = otlpRandomHex(16);
-    const spanId = otlpRandomHex(8);
+    const { observability, sampling } = options;
+    const requestMeta = requestTelemetryMeta(request);
+    const { decision, ignoredUpstream, trace } = beginDispatchTrace(request, {
+      ...sampling === void 0 ? {} : { sampling },
+      trustInbound: isTrustedUpstream(request)
+    });
+    if (ignoredUpstream) {
+      noticeDroppedTrace();
+    }
+    const outgoingHeaders = {
+      ...forwardedHeaders,
+      "x-lunora-sample-errors": decision.keepErrors ? "1" : "0"
+    };
+    injectTraceContext(trace, outgoingHeaders);
     const forwarded = new Request(`https://shard.internal/rpc`, {
       body: JSON.stringify({ args, functionPath }),
-      headers: { ...forwardedHeaders, traceparent: buildTraceparent(traceId, spanId) },
+      headers: outgoingHeaders,
       method: "POST"
     });
     try {
@@ -2790,28 +3127,33 @@ const createWorker = (options) => {
       emitRpcEvent(
         observability,
         {
+          ...requestMeta,
+          ...traceEventFields(trace),
           durationMs: Date.now() - rpcStartedAt,
           functionPath,
           ok: response.ok,
           shardKey,
-          spanId,
-          traceId,
           ...response.ok ? {} : { error: { code: "SHARD_ERROR", message: `shard returned ${String(response.status)}`, status: response.status } }
         },
-        sinkContext
+        sinkContext,
+        sampling
       );
       return response;
     } catch (error) {
-      emitRpcEvent(observability, { ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey }), spanId, traceId }, sinkContext);
+      emitRpcEvent(
+        observability,
+        {
+          ...requestMeta,
+          ...traceEventFields(trace),
+          ...buildErrorEvent(functionPath, Date.now() - rpcStartedAt, error, { shardKey })
+        },
+        sinkContext,
+        sampling
+      );
       throw error;
     }
   };
-  const handleRpc = async (request, env, context) => {
-    if (request.method !== "POST") {
-      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
-    }
-    const envelope = await parseEnvelope(request);
-    logRpcDebug(env, envelope);
+  const assertDispatchableEnvelope = (envelope) => {
     if (envelope.fanOut && envelope.shardKey) {
       throw new LunoraError("RPC envelope cannot set both `shardKey` and `fanOut`", { code: "BAD_REQUEST", status: 400 });
     }
@@ -2827,17 +3169,26 @@ const createWorker = (options) => {
         status: 400
       });
     }
+  };
+  const handleRpc = async (request, env, context) => {
+    if (request.method !== "POST") {
+      throw new LunoraError("RPC endpoint requires POST", { code: "METHOD_NOT_ALLOWED", status: 405 });
+    }
+    const envelope = await parseEnvelope(request);
+    logRpcDebug(env, envelope);
+    assertDispatchableEnvelope(envelope);
+    const reservedResponse = await serveReservedWorkerRpc(request, envelope);
+    if (reservedResponse !== void 0) {
+      return reservedResponse;
+    }
     const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
     await authorizeRpcEnvelope(envelope, identity);
     const x402Tag = resolveX402Charge(envelope, options);
     {
       const rpcStartedAt = Date.now();
       const { observability } = options;
-      const sinkContext = context ? {
-        waitUntil: (promise) => {
-          context.waitUntil?.(promise);
-        }
-      } : void 0;
+      const requestMeta = requestTelemetryMeta(request);
+      const sinkContext = buildSinkContext(env, request, context && ((promise) => context.waitUntil?.(promise)));
       if (envelope.fanOut) {
         const coordinator = options.queryCoordinator;
         if (!coordinator) {
@@ -2863,6 +3214,7 @@ const createWorker = (options) => {
                 table: envelope.fanOut.table
               },
               functionPath: envelope.functionPath,
+              ...requestMeta,
               ok: true
             },
             sinkContext
@@ -2874,14 +3226,17 @@ const createWorker = (options) => {
         } catch (error) {
           emitRpcEvent(
             observability,
-            buildErrorEvent(envelope.functionPath, Date.now() - rpcStartedAt, error, { fanOut: { table: envelope.fanOut.table } }),
+            {
+              ...buildErrorEvent(envelope.functionPath, Date.now() - rpcStartedAt, error, { fanOut: { table: envelope.fanOut.table } }),
+              ...requestMeta
+            },
             sinkContext
           );
           throw error;
         }
       }
       const shardKey = envelope.shardKey ?? defaultShard;
-      const dispatch = () => dispatchSingleShard(envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
+      const dispatch = () => dispatchSingleShard(request, envelope.functionPath, envelope.args ?? {}, shardKey, forwardedHeaders, sinkContext);
       if (x402Tag && options.x402Charge) {
         return options.x402Charge(request, { functionPath: envelope.functionPath, price: x402Tag.price }, dispatch);
       }
@@ -2927,11 +3282,8 @@ const createWorker = (options) => {
       )
     );
     const { observability } = options;
-    const sinkContext = context ? {
-      waitUntil: (promise) => {
-        context.waitUntil?.(promise);
-      }
-    } : void 0;
+    const sinkContext = buildSinkContext(env, request, context && ((promise) => context.waitUntil?.(promise)));
+    const requestMeta = requestTelemetryMeta(request);
     const results = [];
     const bookmarks = [];
     const slotError = (entry, status, code, message) => {
@@ -2952,6 +3304,7 @@ const createWorker = (options) => {
           {
             durationMs,
             functionPath: entry.functionPath,
+            ...requestMeta,
             ok,
             shardKey,
             ...ok ? {} : { error: { code: "SHARD_ERROR", message: `batched call returned ${String(status)}`, status } }
@@ -2972,13 +3325,12 @@ const createWorker = (options) => {
         } catch (error) {
           const durationMs2 = Date.now() - subStartedAt;
           const { body: errorBody } = toErrorBody(error, { fallbackCode: "SHARD_UNAVAILABLE", redactedMessage: "shard unavailable" });
-          failSubBatch(
-            entries,
-            502,
-            errorBody.code,
-            errorBody.message,
-            (entry) => buildErrorEvent(entry.functionPath, durationMs2, error, { shardKey })
-          );
+          failSubBatch(entries, 502, errorBody.code, errorBody.message, (entry) => {
+            return {
+              ...buildErrorEvent(entry.functionPath, durationMs2, error, { shardKey }),
+              ...requestMeta
+            };
+          });
           return;
         }
         const durationMs = Date.now() - subStartedAt;
@@ -2996,6 +3348,7 @@ const createWorker = (options) => {
               durationMs,
               error: { code: "SHARD_ERROR", message, status: response.status },
               functionPath: entry.functionPath,
+              ...requestMeta,
               ok: false,
               shardKey
             };
@@ -3030,7 +3383,8 @@ const createWorker = (options) => {
       const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
       await authorizeRpcEnvelope({ functionPath, shardKey: callOptions.shardKey }, identity);
       const shardKey = callOptions.shardKey ?? defaultShard;
-      return await dispatchSingleShard(functionPath, args, shardKey, forwardedHeaders);
+      const serverSinkContext = buildSinkContext(env, request, callOptions.waitUntil);
+      return await dispatchSingleShard(request, functionPath, args, shardKey, forwardedHeaders, serverSinkContext);
     } catch (error) {
       return toErrorResponse(error);
     }
@@ -3171,6 +3525,25 @@ const createWorker = (options) => {
     }
     return authResponse;
   };
+  const invokeExposed = async ({ args, env, functionPath, request, shardKey, waitUntil }) => {
+    const envelope = { functionPath, ...shardKey === void 0 ? {} : { shardKey } };
+    const { headers: forwardedHeaders, identity } = await resolveForwardContext(request, env, publicResolveIdentity);
+    await authorizeRpcEnvelope(envelope, identity);
+    const resolvedShardKey = shardKey ?? defaultShard;
+    const restSinkContext = buildSinkContext(env, request, waitUntil);
+    const dispatch = () => dispatchSingleShard(request, functionPath, args, resolvedShardKey, forwardedHeaders, restSinkContext);
+    const x402Tag = resolveX402Charge(envelope, options);
+    if (x402Tag && options.x402Charge) {
+      return options.x402Charge(request, { functionPath, price: x402Tag.price }, dispatch);
+    }
+    return dispatch();
+  };
+  const restRoutes = buildRestRoutes({
+    functions: options.functions ?? {},
+    invoke: invokeExposed,
+    readJsonBody: readJsonBodyWithLimit,
+    ...options.restRateLimit ? { rateLimit: options.restRateLimit } : {}
+  });
   const customRoutes = options.routes !== void 0 && Object.keys(options.routes).length > 0 ? options.routes : void 0;
   const internalRoutes = {
     [STATUS_PATH]: (request) => {
@@ -3216,6 +3589,14 @@ const createWorker = (options) => {
     ...kvAdminRoutes,
     ...logArchiveAdminRoutes,
     ...introspectionAdminRoutes,
+    // `/_lunora/health` + `/_lunora/health/ready` — public (or admin-gated)
+    // liveness/readiness probes; not under the admin prefix, so `applyAdminGate`
+    // never runs on them (the handler self-gates when `auth: "admin"`).
+    ...healthRoutes,
+    // `/_lunora/rest/<namespace>/<fn>` — the opt-in public REST surface, one
+    // route per `.expose({ rest: true })` procedure (default-closed). Routes
+    // THROUGH the procedure, so auth/RLS/validators are enforced at the shard.
+    ...restRoutes,
     // `/_lunora/admin/auth/*` — the whole user-management plane, one route per
     // `AuthAdmin` op, dispatched by the descriptor table in `./auth-admin-routes`.
     ...buildAuthAdminRoutes({
@@ -3354,4 +3735,4 @@ const resolveLunoraOptions = (options, env) => {
 const createLunoraHandler = (options = {}) => (request, env, context) => createWorker(resolveLunoraOptions(options, env)).fetch(request, env, context ?? NOOP_EXECUTION_CONTEXT);
 const defineRpcEnvelope = (envelope) => envelope;
 
-export { NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };
+export { GET_AUTH_AUDIT_LOG_OP, NOOP_EXECUTION_CONTEXT, composeWorker, createLunoraHandler, createWorker, defineRpcEnvelope, probeRelayCount, resolveLunoraOptions, withFrameworkWorker };